Dotaz: scponlyc - connection closed (?)

[Stanislav Motyčka]

Distr. : FC5
verzia scponly : scponly-4.6 (z tarballu)
Konfiguracia scponly-4.6 :

shell> ./configure --enable-winscp-compat --enable-sftp-logging-compat --enable-scp-compat --enable-chrooted-binary --with-sftp-server=/usr/libexec/openssh/sftp-server

shell> make
shell> make jail


/usr/bin/install -c -d /usr/local/bin
/usr/bin/install -c -d /usr/local/man/man8
/usr/bin/install -c -d /usr/local/etc/scponly
/usr/bin/install -c -o 0 -g 0 scponly /usr/local/bin/scponly
/usr/bin/install -c -o 0 -g 0 -m 0644 scponly.8 /usr/local/man/man8/scponly.8
/usr/bin/install -c -o 0 -g 0 -m 0644 debuglevel /usr/local/etc/scponly/debuglevel
if test "xscponlyc" != "x"; then                        \
        /usr/bin/install -c -d /usr/local/sbin;                         \
        rm -f /usr/local/sbin/scponlyc;                 \
        cp scponly scponlyc;                            \
        /usr/bin/install -c -o 0 -g 0 -m 4755 scponlyc /usr/local/sbin/scponlyc;        \
fi
chmod u+x ./setup_chroot.sh
./setup_chroot.sh

Next we need to set the home directory for this scponly user.
please note that the user's home directory MUST NOT be writeable
by the scponly user. this is important so that the scponly user
cannot subvert the .ssh configuration parameters.

for this reason, a writeable subdirectory will be created that
the scponly user can write into.

Username to install [scponly]scptest
home directory you wish to set for this user [/home/scptest]/home/scpusers/scptest
name of the writeable subdirectory [incoming]public_www
useradd: upozornenie: domáci adresár už existuje.
Zo skel adresára sa tam neskopíruje žiaden súbor.

creating  /home/scpusers/scptest/public_www directory for uploading files

Your platform (Linux) does not have a platform specific setup script.
This install script will attempt a best guess.
If you perform customizations, please consider sending me your changes.
Look to the templates in build_extras/arch.
 - joe at sublimation dot org

please set the password for scptest:
Changing password for user scptest.
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
if you experience a warning with winscp regarding groups, please install
the provided hacked out fake groups program into your chroot, like so:
cp groups /home/scpusers/scptest/bin/groups

shell> cp groups /home/scpusers/scptest/bin/groups

v adresari /home/scpusers/scptest sa vytvorila adresarova struktura:

shell> tree -r /home/scpusers/scptest/

/home/scpusers/scptest/
|-- usr
|   |-- libexec
|   |   `-- openssh
|   |       `-- sftp-server
|   |-- lib
|   |   |-- libz.so.1
|   |   |-- libkrb5support.so.0
|   |   |-- libkrb5.so.3
|   |   |-- libk5crypto.so.3
|   |   `-- libgssapi_krb5.so.2
|   `-- bin
|       |-- scp
|       |-- id
|       `-- groups
|-- public_www
|-- lib
|   |-- libutil.so.1
|   |-- libsepol.so.1
|   |-- libselinux.so.1
|   |-- librt.so.1
|   |-- libresolv.so.2
|   |-- libpthread.so.0
|   |-- libnss_compat.so.2
|   |-- libnss_compat-2.4.so
|   |-- libnsl.so.1
|   |-- libdl.so.2
|   |-- libcrypto.so.6
|   |-- libcrypt.so.1
|   |-- libcom_err.so.2
|   |-- libc.so.6
|   |-- libattr.so.1
|   |-- libacl.so.1
|   `-- ld-linux.so.2
|-- etc
|   |-- passwd
|   |-- ld.so.conf
|   `-- ld.so.cache
`-- bin
    |-- rmdir
    |-- rm
    |-- pwd
    |-- mv
    |-- mkdir
    |-- ls
    |-- ln
    |-- groups
    |-- echo
    |-- chown
    |-- chmod
    `-- chgrp

kontrola /etc/shells ->

shell> cat /etc/shells

/bin/sh
/bin/bash
/sbin/nologin
/bin/tcsh
/bin/csh
/bin/ksh
/usr/local/bin/scponly
/usr/local/sbin/scponlyc

kontrola /etc/passwd ->
scptest:x:510:510::/home/scpusers/scptest:/usr/local/sbin/scponlyc
setuid pre scponlyc je tiez nastavene '-rwsr-xr-x'

skuska spojenia: ->
WinSCP-3.8.2 z 192.168.0.2

shell> tail /var/log/secure

Oct 26 12:15:28 spravca sshd[2441]: Accepted password for scptest from 192.168.0.2 port 1377 ssh2
Oct 26 10:15:30 spravca scponly[2444]: running: /usr/bin/groups (username: scptest(510), IP/port: 192.168.235.73 1377 22)
Oct 26 10:15:30 spravca scponly[2445]: failed: /usr/bin/groups with error No such file or directory(2) (username: scptest(510), IP/port: 192.168.0.2 1377 22)

-to bolo pri pouziti scp spojenia z WinSCP
-pise ze nevie nasjt /usr/bin/groups (zrejme uz to v chroote, pritom tam je)

Oct 26 12:15:54 spravca sshd[2448]: Accepted password for scptest from 192.168.0.2 port 1378 ssh2
Oct 26 12:15:54 spravca sshd[2448]: subsystem request for sftp
Oct 26 10:15:54 spravca scponly[2450]: running: /usr/libexec/openssh/sftp-server (username: scptest(510), IP/port: 192.168.0.2 1378 22)

-to bolo pri pouziti sftp spojenia z WinSCP

pokus o spojenie z linuxu:

sftp scptest@localhost
Connecting to localhost...
scptest@localhost's password:
Connection closed

vypis v logoch:
Oct 26 12:05:21 spravca sshd[2366]: Accepted password for scptest from 127.0.0.1 port 41827 ssh2
Oct 26 12:05:21 spravca sshd[2366]: subsystem request for sftp
Oct 26 10:05:21 spravca scponly[2367]: running: /usr/libexec/openssh/sftp-server (username: scptest(510), IP/port: 127.0.0.1 41827 22)

Problem: autentifikacia prebehne v poriadku, zlyha spojenie pri pripajani sa z WINSCP z ineho PC Connection closed

Odpovědi

[panko]

shell

scponlyc

potrebuje v chroot prostredi

/dev/null

viz. link