Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

OpenSSH ignores pam_chroot?

2 views
Skip to first unread message

Alee

unread,
Sep 14, 2003, 8:55:49 PM9/14/03
to
I put pam_chroot configrations into /etc/pam.d/sshd, but nothing happened.
Someone told me OpenSSH ignores pam_chroot directives, is it true?
Or any other configration has to be done?
Thx

Darren Tucker

unread,
Sep 14, 2003, 10:10:02 PM9/14/03
to
In article <Xns93F75AABBC0CC...@130.133.1.4>,

Try adding "UsePrivilegeSeparation no" into your sshd_config.

In 3.6.1p2 with Privilege Separation on (the default), do_pam_session
is called after sshd has dropped privs. Chroot requires root privs.

You could also try a current snapshot[0]. The PAM code has been
overhauled and do_pam_session is now called just before dropping privs,
so it should work even with PrivSep on.

[0] ftp://ftp.ca.openbsd.org/pub/OpenBSD/OpenSSH/portable/snapshot

--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

Alee

unread,
Sep 15, 2003, 2:55:31 AM9/15/03
to
dtu...@dodgy.net.au (Darren Tucker) wrote in
news:bk371q$d33$1...@gate.dodgy.net.au:

> In article <Xns93F75AABBC0CC...@130.133.1.4>,
> Alee <Ale...@yahoo.com> wrote:
>>I put pam_chroot configrations into /etc/pam.d/sshd, but nothing
>>happened. Someone told me OpenSSH ignores pam_chroot directives, is it
>>true? Or any other configration has to be done?
>
> Try adding "UsePrivilegeSeparation no" into your sshd_config.
>
> In 3.6.1p2 with Privilege Separation on (the default), do_pam_session
> is called after sshd has dropped privs. Chroot requires root privs.
>
> You could also try a current snapshot[0]. The PAM code has been
> overhauled and do_pam_session is now called just before dropping
> privs, so it should work even with PrivSep on.
>
> [0] ftp://ftp.ca.openbsd.org/pub/OpenBSD/OpenSSH/portable/snapshot
>

Thank you Darren Tucker
I am using OpenSSH_3.1p1 from RH8.0 rpm package.
I've download the souce code, you mean I have to compile it by hand?

Darren Tucker

unread,
Sep 15, 2003, 4:28:36 AM9/15/03
to
In article <Xns93F797A90FD2E...@130.133.1.4>,

Alee <Ale...@yahoo.com> wrote:
>I am using OpenSSH_3.1p1 from RH8.0 rpm package.
>I've download the souce code, you mean I have to compile it by hand?

Yes, or wait for Redhat to repackage it.

There's an example specfile in contrib/redhat, you can build an RPM
by editting it as appropriate then running rpmbuild -bb /path/to/specfile.

Nico Kadel-Garcia

unread,
Sep 15, 2003, 7:55:48 PM9/15/03
to
Darren Tucker wrote:

> In article <Xns93F797A90FD2E...@130.133.1.4>,
> Alee <Ale...@yahoo.com> wrote:
>
>>I am using OpenSSH_3.1p1 from RH8.0 rpm package.
>>I've download the souce code, you mean I have to compile it by hand?
>
>
> Yes, or wait for Redhat to repackage it.
>
> There's an example specfile in contrib/redhat, you can build an RPM
> by editting it as appropriate then running rpmbuild -bb /path/to/specfile.
>

You can also more easily staple the new source code tarball into the old
SRPM distribution, edit the .spec file, and recompile from that. RedHat
and OpenSSH disagree in a bunch of little ways about where and how
things should be, so I'd stick with the RedHat spec file in this case.

0 new messages