Slashdot Mirror

← Back to Stories (view on slashdot.org)

Chroot in OpenSSH

Posted by ScuttleMonkey on from the making-life-easier-always-my-goal dept.

bsdphx writes "OpenSSH developers Damien Miller and Markus Friedl have recently added a nifty feature to make life easier for admins. Now you can easily lock an SSH session into a chroot directory, restrict them to a built-in sftp server and apply these settings per user. And it's dead simple to do. If you need to allow semi-trusted people on your computers, then you want this bad!"

5 of 62 comments (clear)

  1. Why bother? by whoever57 · · Score: 3, Insightful

    Didn't we just read that chroot "jails" are not secure?

    --
    The real "Libtards" are the Libertarians!
    1. Re:Why bother? by Anonymous Coward · · Score: 0, Insightful

      When has that ever stopped the OpenBSD/OpenSSH developers? Security is what they say it is.

    2. Re:Why bother? by bsdphx · · Score: 5, Insightful

      Understanding the issues is better than parroting what you've heard from random sources. Given the OpenBSD and OpenSSH track record for security it's obvious they have some serious clues about security.

  2. Re:Oh thank god by pembo13 · · Score: 2, Insightful

    All we need now is some form of virtual user system that can be mapped to a real, unprivileged user, preferably with a flexible auth system.

    --
    "Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
  3. Re:all that for sftp? by evilviper · · Score: 3, Insightful

    WebDav with ApacheSSL properly installed is lots safer.

    Why? No privilege separation. A MUCH bigger code base.

    Not to mention fewer standalone programs.

    IMHO there should never be user accounts on a machine,

    Why not? The user security model is reliable and time tested. It does not require reinventing the "user". It does not depend on one program handling it's own system of virtual permissions correctly. It does not depend on the security of a large program that users directly interact with.

    I can see ample reasons sftp is safer.
    --
    Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant