脳ログ

sftp でchrootする

テストユーザ作成
[root@hoshino-linux ssh]# useradd hoshino
[root@hoshino-linux ssh]# passwd hoshino
[root@hoshino-linux ssh]# mkdir /home/hoshino/chroot
[root@hoshino-linux ssh]# mkdir /home/hoshino/chroot/data
[root@hoshino-linux ssh]# chown -R root:root /home/hoshino
[root@hoshino-linux ssh]# chown -R hoshino:hoshino /home/hoshino/chroot/data

CentOS5.4でもopenssh4.3で古いので
OpenSSH ソースダウンロード
http://www.openssh.com/ja/ 
[root@hoshino-linux ssh]# cd /usr/local/src
[root@hoshino-linux src]# wget http://ftp.jaist.ac.jp/pub/OpenBSD/OpenSSH/portabl...
[root@hoshino-linux src]# tar xvzf openssh-5.3p1.tar.gz
[root@hoshino-linux src]# chown -R root:root openssh-5.3p1
[root@hoshino-linux src]# cd openssh-5.3p1
[root@hoshino-linux openssh-5.3p1]#
[root@hoshino-linux openssh-5.3p1]# ./configure --sysconfdir=/etc/ssh
[root@hoshino-linux openssh-5.3p1]# make
[root@hoshino-linux openssh-5.3p1]# yum erase openssh
[root@hoshino-linux openssh-5.3p1]# make install
[root@hoshino-linux openssh-5.3p1]# cp contrib/redhat/sshd.init /etc/init.d/sshd
[root@hoshino-linux openssh-5.3p1]# vi /etc/init.d/sshd
[root@hoshino-linux openssh-5.3p1]# diff contrib/redhat/sshd.init /etc/init.d/sshd
25,26c25,26
< KEYGEN=/usr/bin/ssh-keygen
< SSHD=/usr/sbin/sshd
---
> KEYGEN=/usr/local/bin/ssh-keygen
> SSHD=/usr/local/sbin/sshd
107c107
<       initlog -c "$SSHD $OPTIONS" && success || failure
---
>       $SSHD $OPTIONS && success || failure
[root@hoshino-linux openssh-5.3p1]#
[root@hoshino-linux openssh-5.3p1]# chkconfig --list | grep sshd
sshd            0:off   1:off   2:on    3:on    4:on    5:on    6:off
[root@hoshino-linux openssh-5.3p1]#
[root@hoshino-linux openssh-5.3p1]# /etc/rc3.d/S55sshd start

chrootの設定
[root@hoshino-linux ~]# cd /etc/ssh
[root@hoshino-linux ssh]# mkdir BACKUP
[root@hoshino-linux ssh]# cp sshd_config BACKUP/sshd_config.20091207
[root@hoshino-linux ssh]# vi sshd_config
[root@hoshino-linux ssh]# diff BACKUP/sshd_config.20091207 sshd_config
119c119,124
< Subsystem     sftp    /usr/libexec/openssh/sftp-server
---
> #Subsystem    sftp    /usr/libexec/openssh/sftp-server
> Subsystem     sftp    intenal-sftp
>
> Match user hoshino
>   ChrootDirectory /home/%u/chroot
>   ForceCommand internal-sftp
[root@hoshino-linux ssh]# /etc/init.d/sshd restart