SFTP jailing in RHEL

SFTP jailing in RHEL

Requirement: Users need only sftp access  and they should be limited to their home directory.

Solution : Chrooted SFTP environment  with disallowing ftp access.

I used RHEL 6.2 Operating System  for  testing

Let the user be suresh .

Create a group; let it be sftponly.

èAdd the group

# groupadd  sftponly

èAdd the users with sftponly group membership.

# useradd -g sftponly -M -d /homedir -s /bin/false suesh  

-M option will help to not create the directory while adding the user. Non-existent shell prevent from interactive logins(SSH/telnet/rsh/rlogin etc)

# passwd suresh

èNow edit SSH server configuration file and comment the default Subsystem entry for sftp and add  “Subsystem                sftp        internal-sftp”  . Append Match block also.

# vi /etc/ssh/sshd_config

#Subsystem       sftp        /usr/libexec/openssh/sftp-server

Subsystem          sftp        internal-sftp

Match Group sftponly                                         

ChrootDirectory /chroots/%u          

AllowTcpForwarding no

ForceCommand       internal-sftp             

X11Forwarding no                                          

Match block matches the group sftponly and applies  below settings to  its members alone.

%u  stands for user_name  ; chrooted directory becomes /chroots/suresh   for  user suresh.

èCreate the directories and set sufficient permissions. 

# mkdir -p /chroots/suresh;chmod 755 /chroots/suresh

# mkdir /chroots/suresh/homedir
# chown suresh:sftponly /chroots/suresh/homedir

To secure from other users reading /chroots/suresh/homedir  contents.

# chmod 750 /chroots/suresh/homedir          

èNow restart SSH service.

# service sshd restart

To block ftp access …add the user name to /etc/vsftpd/ftpusers.

Now suresh has only sftp access (no ssh/telnet/rlogin/rsh/scp/ftp……) and his visibility is limited to /homedir only. For suresh   “/chroots/suresh” becomes the root directory ,ie; “/”. So this kind of setup is pretty secure.

Xlib: PuTTY X11 proxy: wrong authentication protocol attempted

GUI installer fails to launch when executed with sudo

Problem:

 Application GUI installer fails to launch by throwing X related error messages when executed with sudo.

Scenario:

Application team has to install application with root privilleges but security policy does n't allow sharing root password.Here we provided necessary privilleges to the application user via sudo.But when the application user tried to start the install script which invokes a gui

got the following error messages:

Xlib: connection to "localhost:10.0" refused by server

Xlib: PuTTY X11 proxy: wrong authentication protocol attempted

Error: Can't open display: localhost:10.0

Reason:

To get remote display exported to our local machine we need to have proper DISPLAY variable and X authentication for our X server(xming in our case).When the user logs in via ssh client,putty...DISPLAY variable will be set according to the putty X11forwarding configuration,and proper X authentication will be set up by adding entry to ~user/.Xauthority file.When we use sudo to get root privilleges X authentication will be expected from root user's configuration file(/.Xauthority).As the X authentication is updated to ~user/.Xauthority file while logging in to the OS directly via ssh; root user's Xauthority file will not have this information.This is why we get "Xlib: connection to "localhost:10.0" refused by server" message.

Work around:

I just created a softlink from ~user/.Xauthority to ~root/Xauthority.

eg:

# ln -s ~user/.Xauthority  /.Xauthority

This enabled root user to have proper X authentication to connect to xserver(xming) on the local machine.

Note:

When we switch to root user we have to set DISPLAY variable additionally by looking into the DISPLAY variable of the first login.

Eg:

$ echo $DISPLAY

localhost:10.0

$su -

# export DISPLAY=localhost:10.0