Subject: Re: [vserver] chrooted rssh inside a vserver
From: "Jean-François Leroux" <leroux.jeanfrancois@gmail.com>
Date: Tue, 4 Dec 2007 06:33:28 +0100

 Tue, 4 Dec 2007 06:33:28 +0100
Peter > It's done already.

Gyorgy > Yes, I've used both rssh provided script and manual copying
of the files for the chroot.

Here's my tree output
|-- dev
|   `-- null
|-- etc
|   |-- group
|   |-- ld.so.cache
|   |-- ld.so.conf
|   |-- ld.so.hwcappkgs
|   |-- nsswitch.conf
|   |-- passwd
|   `-- shells
|-- lib
|   |-- libcom err.so.2
|   |-- libnss compat-2.3.6.so
|   |-- libnss compat.so.2 -> libnss compat-2.3.6.so
|   |-- libnss files-2.3.6.so
|   |-- libnss files.so.2 -> libnss files-2.3.6.so
|   `-- tls
|       |-- libc.so.6
|       |-- libcrypt.so.1
|       |-- libdl.so.2
|       |-- libnsl.so.1
|       |-- libresolv.so.2
|       `-- libutil.so.1
|-- pubuser
|   `-- etc
|       `-- passwd
`-- usr
    |-- bin
    |   |-- rssh
    |   `-- scp
    `-- lib
        |-- i686
        |   `-- cmov
        |       `-- libcrypto.so.0.9.8
        |-- libgssapi krb5.so.2
        |-- libk5crypto.so.3
        |-- libkrb5.so.3
        |-- libkrb5support.so.0
        |-- libz.so.1
        |-- openssh
        |   `-- sftp-server
        |-- rssh
        |   `-- rssh chroot helper


Strace doesn't show up any library loaded with dlopen()...

From what I see here :
[...]
write(2, "Connecting to localhost...\n", 27) = 27
socketpair(PF FILE, SOCK STREAM, 0, [3, 4]) = 0
clone(child stack=0,
flags=CLONE CHILD CLEARTID|CLONE CHILD SETTID|SIGCHLD,
child tidptr=0xb7ba9928) = 7279
rt sigaction(SIGTERM, NULL, {SIG DFL}, 8) = 0
rt sigaction(SIGTERM, {0x804aaf0, [], 0}, NULL, 8) = 0
rt sigaction(SIGINT, NULL, {SIG DFL}, 8) = 0
rt sigaction(SIGINT, {0x804aaf0, [], 0}, NULL, 8) = 0
rt sigaction(SIGHUP, NULL, {SIG DFL}, 8) = 0
rt sigaction(SIGHUP, {0x804aaf0, [], 0}, NULL, 8) = 0
close(4)                                = 0
close(4)                                = -1 EBADF (Bad file descriptor)
ioctl(0, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
rt sigprocmask(SIG BLOCK, [WINCH], [], 8) = 0
ioctl(1, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
access("/root/.terminfo/x/xterm", R OK) = -1 ENOENT (No such file or directory)
access("/etc/terminfo/x/xterm", R OK)   = -1 ENOENT (No such file or directory)
access("/lib/terminfo/x/xterm", R OK)   = 0
open("/lib/terminfo/x/xterm", O RDONLY|O LARGEFILE) = 4
read(4, "\32\1\34\0\35\0\17\0\235\1&\5", 12) = 12
read(4, "xterm|X11 terminal emulator\0", 28) = 28
read(4, "\0\1\0\0\1\0\0\0\1\0\0\0\0\1\1\0\0\0\0\0\0\0\1\0\0\1\0"..., 29) = 29
read(4, "\0", 1)                        = 1
read(4, "P\0\10\0\30\0\377\377\377\377\377\377\377\377\377\377\377"..., 30) = 30
read(4, "\0\0\4\0\6\0\10\0\31\0\36\0&\0*\0.\0\377\3779\0J\0L\0P"..., 826) = 826
read(4, "\33[Z\0\7\0\r\0\33[%i%p1%d;%p2%dr\0\33[3g\0\33["..., 1318) = 1318
read(4, "", 10)                         = 0
close(4)                                = 0
ioctl(1, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, TIOCGWINSZ, {ws row=58, ws col=133, ws xpixel=0, ws ypixel=0}) = 0
ioctl(0, TIOCGWINSZ, {ws row=58, ws col=133, ws xpixel=0, ws ypixel=0}) = 0
rt sigprocmask(SIG SETMASK, [], NULL, 8) = 0
ioctl(0, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(0, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(0, SNDCTL TMR STOP or TCSETSW, {B38400 opost isig icanon echo ...}) = 0
ioctl(0, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
rt sigprocmask(SIG BLOCK, [HUP INT QUIT TERM CONT STOP TSTP WINCH], [], 8) = 0
rt sigprocmask(SIG SETMASK, [], NULL, 8) = 0
rt sigprocmask(SIG BLOCK, [WINCH], [], 8) = 0
ioctl(1, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, TIOCGWINSZ, {ws row=58, ws col=133, ws xpixel=0, ws ypixel=0}) = 0
ioctl(0, TIOCGWINSZ, {ws row=58, ws col=133, ws xpixel=0, ws ypixel=0}) = 0
rt sigprocmask(SIG SETMASK, [], NULL, 8) = 0
open("/root/.editrc", O RDONLY)         = -1 ENOENT (No such file or directory)
write(3, "\0\0\0\5", 4)                 = 4
write(3, "\1\0\0\0\3", 5)               = 5
read(3, 0x8063fe0, 4)                   = ? ERESTARTSYS (To be restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
read(3, "", 4)                          = 0
write(2, "Connection closed\r\n", 19)   = 19
exit group(255)                         = ?

I wonder if the problem wouldn't come from terminal emulation, but I'm
not sure at all.



So I'm back with my intial question : did somebody successfully used a
chrooted rssh shell inside a vserver (mine is debian, btw) ?




2007/12/2, Peter Mann <Peter.Mann@tuke.sk>:
> On Sun, Dec 02, 2007 at 06:29:43PM +0100, Jean-François Leroux wrote:
> > I get a 'connection closed' as soon as I try to connect via sftp or
>
> > I followed this howto :
> > http://gentoo-wiki.com/HOWTO SFTP Server (chrooted, without shell)
>
> http://gentoo-wiki.com/HOWTO SFTP Server (chrooted, without shell)#Solution to .22connection
closed.22
>
> so you must have /path/to/chroot/dev/null
>
> --
>
> 5o   Peter.Mann at tuke.sk
>
>
>