jailkit for chroot ssh account security tutorial and fix for error

This was done on Centos but I think it's easier on Debian machines, the paths that it is set to use are tailored towards Debian, so there is some fiddling that needs to be done on Centos.

This is for chrooting ssh, but jailkit has other uses than just SSH jails but I won't cover them in this writeup.

1. Install jailkit

yum install jailkit

2. Setup Jail Home

mkdir /home/jail
chown root:root /home/jail

3. Enable Jailed Programs For Your Users

jk_init -v -j /home/jail basicshell editors extendedshell netutils ssh sftp scp

You'll see a lot of text scrolling, basically it is copying all the executables and their dependencies to the chroot environment.

For more specialized setups/extra programs you can edit /etc/jailkit/jk_init.ini to enable or add more programs.

4. Enable the Jail on an Existing User

jk_jailuser -m -j /home/jail "testguy"


invalid shell, /home/jail/usr/sbin/jk_lsh does not exist
enter jail directory:

Fix the error with the following:

You need to copy "jk_lsh" and should have done it from the start (bad documentation)

jk_init -v -j /home/jail jk_lsh

 Now you can add whatever use you want to the jail.

And just to confirm notice the changed /etc/passwd entry for testguy:

testguy:x:500:500::/home/jail/./home/testguy:/usr/sbin/jk_chrootsh

5. Finalize Settings

Set the shell you want for your user in /home/jail/etc/passwd

root:x:0:0:root:/root:/bin/bash
testguy:x:500:500::/home/testguy:/usr/sbin/jk_lsh

I don't know why "root" is there, I deleted that line.  I also changed the shell for testguy to bash, and so my new file looks like:

testguy:x:500:500::/home/testguy:/bin/bash

 


Tags:

jailkit, chroot, ssh, tutorial, errorthis, centos, debian, paths, tailored, fiddling, chrooting, jails, writeup, install, yum, mkdir, chown, enable, jailed, programs, users, jk_init, basicshell, editors, extendedshell, netutils, sftp, scp, ll, text, scrolling, copying, executables, dependencies, specialized, setups, edit, etc, ini, existing, user, jk_jailuser, quot, testguy, invalid, shell, usr, sbin, jk_lsh, directory, documentation, passwd, entry, jk_chrootsh, finalize, settings, bin, bash, deleted,

Latest Articles

  • Proxmox How To Custom Partition During Install
  • Hyper-V Linux VM Boots to Black Screen, Storage, NIC Not Found Issues
  • Ubuntu Mint How to Fix Missing/Broken /dev and /dev/pts which causes terminal to immediately close exit and not work
  • How high can a Xeon CPU get?
  • bash fix PATH environment variable "command not found" solution
  • Ubuntu Linux Mint Debian Redhat Youtube Cannot Play HD or 4K videos, dropped frames or high CPU usage with Nvidia or AMD Driver
  • hostapd example configuration for high speed AC on 5GHz using WPA2
  • hostapd how to enable and use WPS to connect wireless devices like printers
  • Dell Server Workstation iDRAC Dead after Firmware Update Solution R720, R320, R730
  • Cloned VM/Server/Computer in Linux won't boot and goes to initramfs busybox Solution
  • How To Add Windows 7 8 10 11 to GRUB Boot List Dual Booting
  • How to configure OpenDKIM on Linux with Postfix and setup bind zonefile
  • Debian Ubuntu 10/11/12 Linux how to get tftpd-hpa server setup tutorial
  • efibootmgr: option requires an argument -- 'd' efibootmgr version 15 grub-install.real: error: efibootmgr failed to register the boot entry: Operation not permitted.
  • Apache Error Won't start SSL Cert Issue Solution Unable to configure verify locations for client authentication SSL Library Error: 151441510 error:0906D066:PEM routines:PEM_read_bio:bad end line SSL Library Error: 185090057 error:0B084009:x509 certif
  • Linux Debian Mint Ubuntu Bridge br0 gets random IP
  • redis requirements
  • How to kill a docker swarm
  • docker swarm silly issues
  • isc-dhcp-server dhcpd how to get longer lease