pymumu / jail-shell

Jail-shell is a linux security tool mainly using chroot, namespaces technologies, limiting users to perform specific commands, and access sepcific directories.
GNU General Public License v2.0
116 stars 20 forks source link

/home/user is empty #16

Open jaimbh opened 1 year ago

jaimbh commented 1 year ago

I jailed an already created user using your commands. The /home/user directory has files and directories like public_html, mail, www, ssl, etc. But in the jailed environment, the /home/user directory is empty. I checked that in WinSCP. I want that when I jail user, the home folder should retain all its files and folders.

pymumu commented 1 year ago

Try the following configuration:

bind /home/%u /home/ rw,nodev,nosuid
jaimbh commented 1 year ago

yes it worked after I added your given command in the jail configuration below:

Base directory binding configuration

Set directory read-only, and prohibit device files

bind / ro,nodev,nosuid bind /dev ro,dev,noexec,nosuid bind /home/user /home/user rw,nodev,nosuid

But when I try to open a file inside /home/user through winSCP, I get the below error: Cannot execute SCP to start transfer. Please make sure that SCP is installed on the server and path to it is included in PATH. You may also try SFTP instead of SCP. Command failed with return code 127.

I got this error when I tried opening some files in /home/user. Thanks

pymumu commented 1 year ago

You should copy scp command into jail.

clink  /usr/bin/scp /usr/bin/scp
jaimbh commented 1 year ago

I want to put 5 users in the same jail. But those users should not be able to access other users' /home directory.

pymumu commented 1 year ago
bind /home/%u /home/ rw,nodev,nosuid

%u means user name

jaimbh commented 1 year ago

How to give a jailed user access to entire /usr directory using bind mounts? I tried adding "bind /usr /usr ro,nodev,exec,nosuid" in jail conf. It did not work for me.

pymumu commented 1 year ago

Bind the entire /usr directory is not supported because the /usr/bin/init program in the jail is required.