OpenSsh: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 45: | Zeile 45: | ||
== Chroot für Login: == | == Chroot für Login: == | ||
* /usr/local/bin/ | * /usr/local/bin/MkChroot.pl: | ||
<pre>#! /bin/ | <pre>cat <<'EOS' >/usr/local/bin/MkChroot.pl | ||
#! /usr/bin/perl | |||
use strict; | |||
my $gv_zip = "/tmp/chroot.zip"; | |||
my $prog = shift; | |||
my %gv_files; | |||
if ($prog eq ''){ | |||
die "usage: LbSrch.pl <program>"; | |||
} | } | ||
if ($prog !~ m!/!){ | |||
$prog = qx(which $prog); | |||
} | |||
&Init; | |||
&HandleLibs($prog); | |||
exit 0; | |||
;; | |||
sub HandleLibs{ | |||
my $prog = shift; | |||
;; | my @lines = qx(ldd $prog); | ||
foreach my $line(@lines){ | |||
# => /lib/x86_64-linux-gnu/libdl.so.2 | |||
if ($line =~ m!^\s*(/\S+)!){ | |||
&Add($1); | |||
} elsif ($line =~ m!=> (/\S+)!){ | |||
&Add($1); | |||
} else { | |||
print "ignored: $line"; | |||
} | |||
} | |||
} | |||
sub Add { | |||
my $file = shift; | |||
if ($gv_files{$file} eq ''){ | |||
my $cmd = "zip -9 $gv_zip $file"; | |||
print $cmd, "\n"; | |||
system($cmd); | |||
$gv_files{$file} = 1; | |||
&HandleLibs($file); | |||
} | |||
} | |||
sub Init{ | |||
foreach(qx(unzip -Z -1 $gv_zip)){ | |||
chomp; | |||
$gv_files{"/$_"} = 1; | |||
} | |||
} | |||
EOS | |||
</pre> | </pre> | ||
* Mount als /etc/fstab-Eintrag: | * Mount als /etc/fstab-Eintrag: | ||
<pre>/usr /opt/jail_site/usr none bind 0 0 | <pre>/usr /opt/jail_site/usr none bind 0 0 | ||
</pre> | </pre> | ||
Version vom 26. August 2018, 20:56 Uhr
Konfiguration
Schlüsselgenerierung
ssh-keygen -t rsa -b 4096
ssh-Sitzung mit Schlüssel
- id_rsa.pub auf dem Zielrechner in die Datei authorized_keys eintragen
- Verzeichnis ist das Homeverzeichnis des Users, mit dem angemeldet wird.
chmod 755 .ssh chmod 600 .ssh/authorized_keys
Kommandos
ssh -i /home/jonny/id_rsa jonny@extern.host.de rsync -e "ssh -i /home/jonny/id_rsa" /home backup@backup.example.com
SFTP-chroot-Umgebung
- /etc/ssh/sshd_config
Match Group sftponly
ChrootDirectory /home/%u
ForceCommand internal-sftp
AllowTcpForwarding no
oder
Match User jonny
ChrootDirectory /opt/jail_jonny
ForceCommand internal-sftp
AllowTcpForwarding no
- Rechte /opt/jail_jonny:
DIR=/opt/jail_jonny chown root.root $DIR chmod 755 $DIR
- Eintrag in /etc/fstab:
/data/dir1 /opt_jail_jonny none bind
Chroot für Login:
- /usr/local/bin/MkChroot.pl:
cat <<'EOS' >/usr/local/bin/MkChroot.pl
#! /usr/bin/perl
use strict;
my $gv_zip = "/tmp/chroot.zip";
my $prog = shift;
my %gv_files;
if ($prog eq ''){
die "usage: LbSrch.pl <program>";
}
if ($prog !~ m!/!){
$prog = qx(which $prog);
}
&Init;
&HandleLibs($prog);
exit 0;
sub HandleLibs{
my $prog = shift;
my @lines = qx(ldd $prog);
foreach my $line(@lines){
# => /lib/x86_64-linux-gnu/libdl.so.2
if ($line =~ m!^\s*(/\S+)!){
&Add($1);
} elsif ($line =~ m!=> (/\S+)!){
&Add($1);
} else {
print "ignored: $line";
}
}
}
sub Add {
my $file = shift;
if ($gv_files{$file} eq ''){
my $cmd = "zip -9 $gv_zip $file";
print $cmd, "\n";
system($cmd);
$gv_files{$file} = 1;
&HandleLibs($file);
}
}
sub Init{
foreach(qx(unzip -Z -1 $gv_zip)){
chomp;
$gv_files{"/$_"} = 1;
}
}
EOS
- Mount als /etc/fstab-Eintrag:
/usr /opt/jail_site/usr none bind 0 0