From darrenm@sac.sfbay.sun.com Thu Mar 5 04:02:22 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n25C2Lc9012255 for ; Thu, 5 Mar 2009 04:02:22 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n25C2EbH012628; Thu, 5 Mar 2009 20:02:20 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KG10020D83U9K00@nwk-avmta-2.sfbay.sun.com>; Thu, 05 Mar 2009 04:02:18 -0800 (PST) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KG100FSD83TB9B0@nwk-avmta-2.sfbay.sun.com>; Thu, 05 Mar 2009 04:02:18 -0800 (PST) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n25C2GgL062326; Thu, 05 Mar 2009 04:02:16 -0800 (PST) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n25C2BLl010991; Thu, 05 Mar 2009 04:02:11 -0800 (PST) Received: (from darrenm@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n25C2B25010980; Thu, 05 Mar 2009 04:02:11 -0800 (PST) Date: Thu, 05 Mar 2009 04:02:11 -0800 (PST) From: Darren J Moffat Subject: ChrootDirectory option for SunSSH server [PSARC/2009/155 Self Review] To: PSARC-ext@sun.com Cc: Jan.Pechanec@sun.com Message-id: <200903051202.n25C2B25010980@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 7380 Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI This information is Copyright 2009 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: ChrootDirectory option for SunSSH server 1.2. Name of Document Author/Supplier: Jan Pechanec 1.3. Date of This Document: 2009-03-04 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.2. The ARC(s) you expect to review your project: PSARC 1.4.4. The name of your business unit: Security 1.5. Email Aliases: 1.5.1. Responsible Manager: Anup.Sekhar@Sun.COM 1.5.2. Responsible Engineer: Jan.Pechanec@Sun.COM 1.5.4. Interest List: security-discuss@opensolaris.org 2. Project Summary 2.1. Project Description: The goal of this project is to implement the ChrootDirectory option according to how OpenSSH implemented it in the 5.0p1 version (released 2008-04-03). Using this server side option the server will chroot the connected clients after the authentication is over to the directory specified in the option. Part of the project is to implement an in-process SFTP server (aka internal SFTP) which greatly simplifies configurations using the ChrootDirectory option. We fully follow how ChrootDirectory is used by OpenSSH so users that use this features in OpenSSH should be able to use it with SunSSH without any configuration changes. 2.2. Risks and Assumptions: None. 3. Business Summary 3.1. Problem Area: Customers want this feature that they can find in OpenSSH. 3.3. Business Justification: There are 14 service records with 5043377. 4. Technical Description: 4.1. Details: ChrootDirectory path specifies that the server will call chroot(2) on it after the authentication is over. This feature is about the SSH server only. All components of the chroot path MUST be root owned and NOT writable by any other user or group otherwise the connection fails. ChrootDirectory works with both the SFTP and plain SSH connections. With the in-process SFTP server implementation that is part of this project, there is NO need for other configuration of the chrooted directory. However, with the plain SSH or the external SFTP implementation, one has to properly populate the chroot directory with (at least) a user's shell and all its shared libraries, the dynamic linker, and possibly terminal databases and devices like /dev/null etc. The in-process SFTP server is configured using the "internal-sftp" keyword in place of the SFTP server binary: Subsystem sftp internal-sftp If the ChrootDirectory is used with the external SFTP server binary (/usr/lib/ssh/sftp-server) or with the plain SSH connection without a properly populated chroot directory, the connection fails. The manual page draft below discusses the non in-process SFTP case and the need to prepare the chroot directory beforehand. The "internal-sftp" will be the new default value for the "sftp" subsystem already configured in the "Subsystem" option delivered in /etc/ssh/sshd_config but we will NOT update the existing server configurations upon the system upgrades. After the chroot(2) is called, the SSH server tries to find the user's home directory relatively under the chrooted environment and chdir(2) to it but the failure to do so is NOT considered an error. In addition to that, there are 3 tokes that can be used in the ChrootDirectory path. %u is replaced by the current user's name, %h is replaced by the user's home directory, and %% is replaced by literal %. A special ChrootDirectory=none configuration effectively disables this option and has the same effect as if the option was not set at all. While I do not think it is needed I follow the OpenSSH implementation so that we do not confuse the customers that used the ChrootDirectory option before with OpenSSH. The implementation will partially use the OpenSSH code. Some code written as part of the project will be specific to SunSSH since we have a different privilege separation code that is affected as well. 4.2. Bug/RFE Number(s): the project implements this RFE: 5043377 provide chroot capability in SunSSH I'll fix following SunSSH CRs as part of this project: 6809398 default PATH in SunSSH is missing important directories 6810759 remove md5crypt.c from SunSSH since it's not used A new CR was filed against the STC-2 SSH test suite and it's integration to STC-2 will part of the project: 6809406 ChrootDirectory option should have its own test case in the SSH test suite 4.5. Interfaces: - we do NOT add any new command line options - we add a new ChrootDirectory option keyword to the server, for use in the sshd_config file, or with the "-o" command line option with sshd(1m) - we change the default Subsystem configuration in the new installations only, so that the in-process SFTP implementation is used instead of the external one. The functionality and the interface to the user will remain unchanged. 4.6. Doc Impact: Manual page sshd_config(4) will be changed. Draft follows: +ChrootDirectory + + Specifies a path to chroot(2) to after authentication. + This path, and all its components, must be root owned + directories that are not writable by any other user or + group. + + The server always tries to change to the user's home + directory locally under the chrooted environment but a + failure to do so it not considered an error. In addition + to that, the path may contain the following tokens that + are expanded at runtime once the connecting user has + been authenticated: %% is replaced by a literal '%', %h + is replaced by the home directory of the user being + authenticated, and %u is replaced by the username of + that user. + + The ChrootDirectory must contain the necessary files and + directories to support the users' session. For an + interactive SSH session this requires at least a user's + shell, shared libraries needed by the shell, dynamic + linker, and possibly basic /dev nodes such as null(4), + zero(4), stdin(4), stdout(4), stderr(4), random(4) and + tty(4) devices, Additionaly, terminal databases are + needed for screen oriented applications. For file + transfer sessions using ``sftp'' with the SSH protocol + version 2, no additional configuration of the + environment is necessary if the in-process sftp server + is used (see Subsystem for details). + + The default is not to chroot(2). + + Subsystem Configures an external subsystem (for example, a file transfer daemon). Arguments should be a subsystem name and a command to execute upon subsystem request. The command sftp-server(1M) implements the sftp file - transfer subsystem. By default, no subsystems are + transfer subsystem. + + Alternately the name ``internal-sftp'' implements an + in-process ``sftp'' server. This may simplify + configurations using ChrootDirectory to force a different + filesystem root on clients. + + By default, no subsystems are defined. This option applies to protocol version 2 only. 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: Automatic 6.6. ARC Exposure: open From carlsonj@phorcys.east.sun.com Thu Mar 5 04:52:18 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n25CqHSG017390 for ; Thu, 5 Mar 2009 04:52:17 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n25CqFuK021051; Thu, 5 Mar 2009 12:52:16 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KG100I03AF4PA00@nwk-avmta-1.sfbay.Sun.COM>; Thu, 05 Mar 2009 04:52:16 -0800 (PST) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KG100K94AF305E0@nwk-avmta-1.sfbay.Sun.COM>; Thu, 05 Mar 2009 04:52:15 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n25Cq9JE007338; Thu, 05 Mar 2009 07:52:09 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id n25Cq8DJ007335; Thu, 05 Mar 2009 07:52:08 -0500 (EST) Date: Thu, 05 Mar 2009 07:52:08 -0500 From: James Carlson Subject: Re: ChrootDirectory option for SunSSH server [PSARC/2009/155 Self Review] In-reply-to: <200903051202.n25C2B25010980@sac.sfbay.sun.com> To: Darren J Moffat Cc: PSARC-ext@sun.com, Jan.Pechanec@sun.com Message-id: <18863.51960.959225.71348@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200903051202.n25C2B25010980@sac.sfbay.sun.com> Status: RO Content-Length: 826 Darren J Moffat writes: > directory. However, with the plain SSH or the external SFTP > implementation, one has to properly populate the chroot directory with > (at least) a user's shell and all its shared libraries, the dynamic > linker, and possibly terminal databases and devices like /dev/null etc. That population task is tough enough to get right that we provide a script with ftpd (ftpconfig) that sets up a usable chroot anon ftp environment. Would something like that be useful here? (Perhaps not for internal-sftp, but rather for an ordinary user account being set up for chroot use.) -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Darren.Moffat@Sun.COM Thu Mar 5 04:57:40 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n25CveZ7017729 for ; Thu, 5 Mar 2009 04:57:40 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n25Cvd5S019577 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 5 Mar 2009 05:57:39 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KG100J03AO2TI00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 05 Mar 2009 04:57:38 -0800 (PST) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KG100JH5ANYAF00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 05 Mar 2009 04:57:35 -0800 (PST) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n25CvYsc018325 for ; Thu, 05 Mar 2009 12:57:34 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) id <0KG100A009QA4J00@fe-emea-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 05 Mar 2009 12:57:34 +0000 (GMT) Received: from [129.156.173.21] ([unknown] [129.156.173.21]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) with ESMTPSA id <0KG100MPBANTRAA0@fe-emea-10.sun.com>; Thu, 05 Mar 2009 12:57:31 +0000 (GMT) Date: Thu, 05 Mar 2009 12:57:29 +0000 From: Darren J Moffat Subject: Re: ChrootDirectory option for SunSSH server [PSARC/2009/155 Self Review] In-reply-to: <18863.51960.959225.71348@gargle.gargle.HOWL> Sender: Darren.Moffat@Sun.COM To: James Carlson Cc: Darren J Moffat , PSARC-ext@Sun.COM, Jan.Pechanec@Sun.COM Message-id: <49AFCC39.90301@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200903051202.n25C2B25010980@sac.sfbay.sun.com> <18863.51960.959225.71348@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 1042 James Carlson wrote: > Darren J Moffat writes: >> directory. However, with the plain SSH or the external SFTP >> implementation, one has to properly populate the chroot directory with >> (at least) a user's shell and all its shared libraries, the dynamic >> linker, and possibly terminal databases and devices like /dev/null etc. > > That population task is tough enough to get right that we provide a > script with ftpd (ftpconfig) that sets up a usable chroot anon ftp > environment. Would something like that be useful here? (Perhaps not > for internal-sftp, but rather for an ordinary user account being set > up for chroot use.) Maybe but I'd rather it wasn't part of this case. The common case for SSH chroot is for SFTP and the use of the internal-sftp is the best solution for that. chroot environments cause a significant patching/pkg update problem and I'd rather not encourage use of building those environments. I suspect the script for ftpd would be sufficiently close to work for SSH anyway. -- Darren J Moffat From Jan.Pechanec@sun.com Thu Mar 5 05:02:25 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n25D2OV0018098 for ; Thu, 5 Mar 2009 05:02:25 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n25D2JVX027805 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 5 Mar 2009 13:02:24 GMT Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KG10050TAVYPY00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 05 Mar 2009 05:02:22 -0800 (PST) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KG1005AGAVXLP00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 05 Mar 2009 05:02:22 -0800 (PST) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe3.eu.sun.com [192.18.6.12]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n25D2LKo019092 for ; Thu, 05 Mar 2009 13:02:21 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) id <0KG100A009QA4J00@fe-emea-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 05 Mar 2009 13:02:21 +0000 (GMT) Received: from fossa.czech.sun.com ([unknown] [129.157.71.113]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) with ESMTPSA id <0KG100G8OAVIMFG0@fe-emea-10.sun.com>; Thu, 05 Mar 2009 13:02:07 +0000 (GMT) Date: Thu, 05 Mar 2009 14:01:00 +0100 (CET) From: Jan Pechanec Subject: Re: ChrootDirectory option for SunSSH server [PSARC/2009/155 Self Review] In-reply-to: <18863.51960.959225.71348@gargle.gargle.HOWL> Sender: Jan.Pechanec@sun.com X-X-Sender: jp161948@fossa.czech.sun.com To: James Carlson Cc: Darren J Moffat , PSARC-ext@sun.com Message-id: MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200903051202.n25C2B25010980@sac.sfbay.sun.com> <18863.51960.959225.71348@gargle.gargle.HOWL> Status: RO Content-Length: 970 On Thu, 5 Mar 2009, James Carlson wrote: >Darren J Moffat writes: >> directory. However, with the plain SSH or the external SFTP >> implementation, one has to properly populate the chroot directory with >> (at least) a user's shell and all its shared libraries, the dynamic >> linker, and possibly terminal databases and devices like /dev/null etc. > >That population task is tough enough to get right that we provide a >script with ftpd (ftpconfig) that sets up a usable chroot anon ftp >environment. Would something like that be useful here? (Perhaps not >for internal-sftp, but rather for an ordinary user account being set as mentioned in the case, if you use internal-sftp, you don't need to put anything there - the process that was created before chroot() also implements the SFTP protocol without any fork()/exec(). I should probably add to the ChrootDirectory man page draft section that the directory must exist beforehand. J. -- Jan Pechanec From carlsonj@phorcys.east.sun.com Thu Mar 5 05:05:19 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n25D5Ipl018128 for ; Thu, 5 Mar 2009 05:05:18 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n25D5DVK029639; Thu, 5 Mar 2009 13:05:17 GMT Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KG100523B0RUK00@nwk-avmta-2.sfbay.sun.com>; Thu, 05 Mar 2009 05:05:15 -0800 (PST) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KG1005MEB0PLN00@nwk-avmta-2.sfbay.sun.com>; Thu, 05 Mar 2009 05:05:14 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n25D57SG007436; Thu, 05 Mar 2009 08:05:07 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id n25D572k007433; Thu, 05 Mar 2009 08:05:07 -0500 (EST) Date: Thu, 05 Mar 2009 08:05:07 -0500 From: James Carlson Subject: Re: ChrootDirectory option for SunSSH server [PSARC/2009/155 Self Review] In-reply-to: <49AFCC39.90301@Sun.COM> To: Darren J Moffat Cc: Darren J Moffat , PSARC-ext@sun.com, Jan.Pechanec@sun.com Message-id: <18863.52739.267864.355418@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200903051202.n25C2B25010980@sac.sfbay.sun.com> <18863.51960.959225.71348@gargle.gargle.HOWL> <49AFCC39.90301@Sun.COM> Status: RO Content-Length: 853 Darren J Moffat writes: > Maybe but I'd rather it wasn't part of this case. The common case for > SSH chroot is for SFTP and the use of the internal-sftp is the best > solution for that. > > chroot environments cause a significant patching/pkg update problem and > I'd rather not encourage use of building those environments. I guess it depends on how strongly users feel about using those environments. (I agree about the update problem. It'd be nice if we had some cleaner solution for that, like a pick-and-choose lofs.) > I suspect the script for ftpd would be sufficiently close to work for > SSH anyway. OK. +1 -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Jan.Pechanec@sun.com Thu Mar 5 05:26:55 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n25DQtjE018419 for ; Thu, 5 Mar 2009 05:26:55 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n25DQtrU015166 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 5 Mar 2009 05:26:55 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KG100719C0V5C00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 05 Mar 2009 05:26:55 -0800 (PST) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KG1005PYC0ULN20@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 05 Mar 2009 05:26:54 -0800 (PST) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n25DQrh6023260 for ; Thu, 05 Mar 2009 13:26:53 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) id <0KG100G00AG2TT00@fe-emea-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 05 Mar 2009 13:26:53 +0000 (GMT) Received: from fossa.czech.sun.com ([unknown] [129.157.71.113]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) with ESMTPSA id <0KG100K5YC0L69B0@fe-emea-10.sun.com>; Thu, 05 Mar 2009 13:26:45 +0000 (GMT) Date: Thu, 05 Mar 2009 14:25:38 +0100 (CET) From: Jan Pechanec Subject: Re: ChrootDirectory option for SunSSH server [PSARC/2009/155 Self Review] In-reply-to: <18863.52739.267864.355418@gargle.gargle.HOWL> Sender: Jan.Pechanec@sun.com X-X-Sender: jp161948@fossa.czech.sun.com To: James Carlson Cc: Darren J Moffat , Darren J Moffat , PSARC-ext@sun.com Message-id: MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200903051202.n25C2B25010980@sac.sfbay.sun.com> <18863.51960.959225.71348@gargle.gargle.HOWL> <49AFCC39.90301@Sun.COM> <18863.52739.267864.355418@gargle.gargle.HOWL> Status: RO Content-Length: 1340 On Thu, 5 Mar 2009, James Carlson wrote: >Darren J Moffat writes: >> Maybe but I'd rather it wasn't part of this case. The common case for >> SSH chroot is for SFTP and the use of the internal-sftp is the best >> solution for that. >> >> chroot environments cause a significant patching/pkg update problem and >> I'd rather not encourage use of building those environments. > >I guess it depends on how strongly users feel about using those >environments. exactly, and chrooted plain SSH connections are very different. For FTP, one doesn't need much and one runs the one command only. For SSH, we need commands there in order to be useful, so we would have to decide which ones. Different commands need different devices. If some of those commands are screen oriented, we would need terminal databases as well. Etc. also, using external sftp-server with ChrootDirectory doesn't make sense with the existence of internal-sftp. I'm working with a simple chroot directory (can do ls after logging in) with SSH in the new STC-2 SSH test case I'll putback together with the project but it's almost useless for the normal work, users would need much nore. Let's leave it to users. I think that more than 99% of people will use ChrootDirectory with internal-sftp only and for that we don't need anything. -- Jan Pechanec