Subject: Re: [vserver] chrooted rssh inside a vserver
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Sun, 2 Dec 2007 12:49:22 +0100

On Sat, Dec 01, 2007 at 05:18:58PM +0100, Jean-François Leroux wrote:
> Hi, i'm trying to set up a a restricted account with rssh 
> inside a  debian vserver.

> So far it doesn't work with the chroot option. 

what exactly fails there?

> As soon as I stop using it, I can connect via sftp.
> So, I guess somethings wrong with my chroot.

> I tried adding various libraries, as stated over several 
> threads in forums, with no avail.

hmm, interesting ... chroot() is a kernel syscall,
so it should not require any extra libraries ...

> One tip I couldn't try was to create a null device 
> inside the chroot directory (mknod not working inside 
> a vserver, am i right here ?).

yes, that is intentional, you can disable it by
adding the proper capability, but it is considered
insecure if you can create arbitrary devices
(without a device mapping feature)

> So I wanted to ask if somebody had succeded in doing 
> so, and possibly how...

chroots inside guests work perfectly fine, if you
need devices inside the chroot (should not be the
case for most services) pre-create them (the secure
ones) by copying them from the guest's /dev dir
(on the host)

> Thanks for your help

HTH,
Herbert