Tue, 4 Dec 2007 06:33:28 +0100 Peter > It's done already. Gyorgy > Yes, I've used both rssh provided script and manual copying of the files for the chroot. Here's my tree output |-- dev | `-- null |-- etc | |-- group | |-- ld.so.cache | |-- ld.so.conf | |-- ld.so.hwcappkgs | |-- nsswitch.conf | |-- passwd | `-- shells |-- lib | |-- libcom err.so.2 | |-- libnss compat-2.3.6.so | |-- libnss compat.so.2 -> libnss compat-2.3.6.so | |-- libnss files-2.3.6.so | |-- libnss files.so.2 -> libnss files-2.3.6.so | `-- tls | |-- libc.so.6 | |-- libcrypt.so.1 | |-- libdl.so.2 | |-- libnsl.so.1 | |-- libresolv.so.2 | `-- libutil.so.1 |-- pubuser | `-- etc | `-- passwd `-- usr |-- bin | |-- rssh | `-- scp `-- lib |-- i686 | `-- cmov | `-- libcrypto.so.0.9.8 |-- libgssapi krb5.so.2 |-- libk5crypto.so.3 |-- libkrb5.so.3 |-- libkrb5support.so.0 |-- libz.so.1 |-- openssh | `-- sftp-server |-- rssh | `-- rssh chroot helper Strace doesn't show up any library loaded with dlopen()... From what I see here : [...] write(2, "Connecting to localhost...\n", 27) = 27 socketpair(PF FILE, SOCK STREAM, 0, [3, 4]) = 0 clone(child stack=0, flags=CLONE CHILD CLEARTID|CLONE CHILD SETTID|SIGCHLD, child tidptr=0xb7ba9928) = 7279 rt sigaction(SIGTERM, NULL, {SIG DFL}, 8) = 0 rt sigaction(SIGTERM, {0x804aaf0, [], 0}, NULL, 8) = 0 rt sigaction(SIGINT, NULL, {SIG DFL}, 8) = 0 rt sigaction(SIGINT, {0x804aaf0, [], 0}, NULL, 8) = 0 rt sigaction(SIGHUP, NULL, {SIG DFL}, 8) = 0 rt sigaction(SIGHUP, {0x804aaf0, [], 0}, NULL, 8) = 0 close(4) = 0 close(4) = -1 EBADF (Bad file descriptor) ioctl(0, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 rt sigprocmask(SIG BLOCK, [WINCH], [], 8) = 0 ioctl(1, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 access("/root/.terminfo/x/xterm", R OK) = -1 ENOENT (No such file or directory) access("/etc/terminfo/x/xterm", R OK) = -1 ENOENT (No such file or directory) access("/lib/terminfo/x/xterm", R OK) = 0 open("/lib/terminfo/x/xterm", O RDONLY|O LARGEFILE) = 4 read(4, "\32\1\34\0\35\0\17\0\235\1&\5", 12) = 12 read(4, "xterm|X11 terminal emulator\0", 28) = 28 read(4, "\0\1\0\0\1\0\0\0\1\0\0\0\0\1\1\0\0\0\0\0\0\0\1\0\0\1\0"..., 29) = 29 read(4, "\0", 1) = 1 read(4, "P\0\10\0\30\0\377\377\377\377\377\377\377\377\377\377\377"..., 30) = 30 read(4, "\0\0\4\0\6\0\10\0\31\0\36\0&\0*\0.\0\377\3779\0J\0L\0P"..., 826) = 826 read(4, "\33[Z\0\7\0\r\0\33[%i%p1%d;%p2%dr\0\33[3g\0\33["..., 1318) = 1318 read(4, "", 10) = 0 close(4) = 0 ioctl(1, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(1, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(1, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(1, TIOCGWINSZ, {ws row=58, ws col=133, ws xpixel=0, ws ypixel=0}) = 0 ioctl(0, TIOCGWINSZ, {ws row=58, ws col=133, ws xpixel=0, ws ypixel=0}) = 0 rt sigprocmask(SIG SETMASK, [], NULL, 8) = 0 ioctl(0, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(0, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(0, SNDCTL TMR STOP or TCSETSW, {B38400 opost isig icanon echo ...}) = 0 ioctl(0, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 rt sigprocmask(SIG BLOCK, [HUP INT QUIT TERM CONT STOP TSTP WINCH], [], 8) = 0 rt sigprocmask(SIG SETMASK, [], NULL, 8) = 0 rt sigprocmask(SIG BLOCK, [WINCH], [], 8) = 0 ioctl(1, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(1, SNDCTL TMR TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(1, TIOCGWINSZ, {ws row=58, ws col=133, ws xpixel=0, ws ypixel=0}) = 0 ioctl(0, TIOCGWINSZ, {ws row=58, ws col=133, ws xpixel=0, ws ypixel=0}) = 0 rt sigprocmask(SIG SETMASK, [], NULL, 8) = 0 open("/root/.editrc", O RDONLY) = -1 ENOENT (No such file or directory) write(3, "\0\0\0\5", 4) = 4 write(3, "\1\0\0\0\3", 5) = 5 read(3, 0x8063fe0, 4) = ? ERESTARTSYS (To be restarted) --- SIGCHLD (Child exited) @ 0 (0) --- read(3, "", 4) = 0 write(2, "Connection closed\r\n", 19) = 19 exit group(255) = ? I wonder if the problem wouldn't come from terminal emulation, but I'm not sure at all. So I'm back with my intial question : did somebody successfully used a chrooted rssh shell inside a vserver (mine is debian, btw) ? 2007/12/2, Peter Mann <Peter.Mann@tuke.sk>: > On Sun, Dec 02, 2007 at 06:29:43PM +0100, Jean-François Leroux wrote: > > I get a 'connection closed' as soon as I try to connect via sftp or > > > I followed this howto : > > http://gentoo-wiki.com/HOWTO SFTP Server (chrooted, without shell) > > http://gentoo-wiki.com/HOWTO SFTP Server (chrooted, without shell)#Solution to .22connection closed.22 > > so you must have /path/to/chroot/dev/null > > -- > > 5o Peter.Mann at tuke.sk > > >