Limit SSH Person Entry to Dwelling Listing Utilizing Chrooted Jail

For an interactive session, this requires at the very least a shell, generally sh, and fundamental /dev nodes corresponding to null, zero, stdin, stdout, stderr, and tty units:

# ls -l /dev/{null,zero,stdin,stdout,stderr,random,tty}

3. Now, create the /dev recordsdata as follows utilizing the mknod command. Within the command beneath, the -m flag is used to specify the file permissions bits, c means character file and the 2 numbers are main and minor numbers that the recordsdata level to.

# mkdir -p /residence/check/dev/		
# cd /residence/check/dev/
# mknod -m 666 null c 1 3
# mknod -m 666 tty c 5 0
# mknod -m 666 zero c 1 5
# mknod -m 666 random c 1 8

4. Afterwards, set the suitable permission on the chroot jail. Be aware that the chroot jail and its subdirectories and subfiles should be owned by the root consumer, and never writable by any regular consumer or group:

# chown root:root /residence/check
# chmod 0755 /residence/check
# ls -ld /residence/check

Step 2: Setup Interactive Shell for SSH Chroot Jail

5. First, create the bin listing after which copy the /bin/bash recordsdata into the bin listing utilizing the cp command as follows:

# mkdir -p /residence/check/bin
# cp -v /bin/bash /residence/check/bin/

6. Now, determine the bash required for shared libs, as beneath, and replica them into the lib listing:

# ldd /bin/bash
# mkdir -p /residence/check/lib64
# cp -v /lib64/{libtinfo.so.5,libdl.so.2,libc.so.6,ld-linux-x86-64.so.2} /residence/check/lib64/

Step 3: Create and Configure SSH Person

7. Now, create the SSH consumer with the useradd command and set a safe password for the consumer:

# useradd tecmint
# passwd tecmint

8. Create the chroot jail normal configurations listing, /residence/check/and so on and replica the up to date account recordsdata (/and so on/passwd and /and so on/group) into this listing as follows:

# mkdir /residence/check/and so on
# cp -vf /and so on/{passwd,group} /residence/check/and so on/

Be aware: Every time you add extra SSH customers to the system, you will have to repeat the up to date account recordsdata into the /residence/check/and so on listing.

Step 4: Configure SSH to Use Chroot Jail

9. Now, open the sshd_config file.

# vi /and so on/ssh/sshd_config

and add/modify the strains beneath within the file.

#outline username to use chroot jail to
Match Person tecmint
#specify chroot jail
ChrootDirectory /residence/check

Save the file and exit, and restart the SSHD providers:

# systemctl restart sshd
OR
# service sshd restart

Step 5: Testing SSH with Chroot Jail

10. At this level, check if the chroot jail setup is working as anticipated:

# ssh [email protected]
-bash-4.1$ ls
-bash-4.1$ date
-bash-4.1$ uname

From the screenshot above, we will see that the SSH consumer is locked within the chrooted jail, and may’t run any exterior instructions (ls, date, uname, and so on).

The consumer can solely execute bash and its builtin instructions corresponding to (pwd, historical past, echo, and so on) as seen beneath:

# ssh [email protected]
-bash-4.1$ pwd
-bash-4.1$ echo "Tecmint - Quickest Rising Linux Website"
-bash-4.1$ historical past

Step 6. Create SSH Person’s Dwelling Listing and Add Linux Instructions

11. From the earlier step, we will discover that the consumer is locked within the root listing, we will create a house listing for the SSH consumer like so (do that for all future customers):

# mkdir -p /residence/check/residence/tecmint
# chown -R tecmint:tecmint /residence/check/residence/tecmint
# chmod -R 0700 /residence/check/residence/tecmint

12. Subsequent, set up just a few consumer instructions corresponding to ls, date, and mkdir within the bin listing:

# cp -v /bin/ls /residence/check/bin/
# cp -v /bin/date /residence/check/bin/
# cp -v /bin/mkdir /residence/check/bin/

13. Subsequent, test the shared libraries for the instructions above and transfer them into the chrooted jail libraries listing:

# ldd /bin/ls
# cp -v /lib64/{libselinux.so.1,libcap.so.2,libacl.so.1,libc.so.6,libpcre.so.1,libdl.so.2,ld-linux-x86-64.so.2,libattr.so.1,libpthread.so.0} /residence/check/lib64/

Step 7. Testing SFTP with Chroot Jail

14. Do a closing check utilizing sftp; test if the instructions you will have simply put in are working.

Add the road beneath within the /and so on/ssh/sshd_config file:

#Allow sftp to chrooted jail 
ForceCommand internal-sftp

Save the file and exit. Then restart the SSHD providers:

# systemctl restart sshd
OR
# service sshd restart

15. Now, check utilizing SSH, and also you’ll get the next error:

# ssh [email protected]

Attempt utilizing SFTP as follows:

# sftp [email protected]

That’s it for now! On this article, we confirmed you learn how to limit an SSH consumer in a given listing (chrooted jail) in Linux. Use the remark part beneath to supply us your ideas about this information.