The standard OpenSSH included in Mac OS X Panther does not support chroot. Largely, two ways are known as chroot solution. The one is scponly (http://www.sublimation.org/scponly/) and the other is chrootssh patch (http://chrootssh.sourceforge.net/). I mention the way applying the chrootssh patch here.
OpenSSH applied the chrootssh patch classifies users to be chrooted or not by '/./' trick like classical wu-ftpd. Additionally, it is able to be defined where to chroot. If home directory of user godzilla is defined as /Users/godzilla/./, godzilla will be chrooted to /Users/godzilla. If /Users/./godzilla, chrooted to /Users. And if /Users/godzilla, godzilla won't be chrooted.
I wrote this page just from curiousity. I don't use this in real life. So I don't know this page's sshd will do it or not in commercial use. And I don't have Panther Server. Panther Server users might find some potential difference.
By the way, this page is wrote by funny engrish. ;)
$ cvs -d :pserver:anonymous@anoncvs.opendarwin.org:/Volumes/src/cvs/od login
(Logging in to anonymous@anoncvs.opendarwin.org)
CVS password:
(note: just press enter key)
$ cvs -d :pserver:anonymous@anoncvs.opendarwin.org:/Volumes/src/cvs/od co src/OpenSSH
$ curl -O http://chrootssh.sourceforge.net/download/osshChroot-3.6.1.diff
$ cd src/OpenSSH/openssh
$ patch -p1 < ../../../osshChroot-3.6.1.diff
$ cd ..
(note: You can edit Makefile to customize build option. However usualy it's not necessary.)
$ make
$ cd /tmp/OpenSSH/Build
$ strip sshd
$ sudo cp sshd /usr/local/sbin/sshd-chroot
$ sudo chown root:wheel /usr/local/sbin/sshd-chroot
$ sudo chmod 755 /usr/local/sbin/sshd-chroot
$ cd /etc/pam.d
$ sudo cp sshd sshd-chroot
testssh 10022/tcp # SSH Remote Login Protocol
Create /etc/xinetd.d/testssh file and configure xinetd for temporary sshd service.
service testssh
{
disable = no
socket_type = stream
wait = no
user = root
#server = /usr/libexec/sshd-keygen-wrapper
server = /usr/local/sbin/sshd-chroot
server_args = -i
groups = yes
flags = REUSE IPv6
session_create = yes
}
$ sudo killall -HUP xinetd
Connect port 10022 and check whether new sshd-chroot works as well as original ssh service.
$ ssh -p 10022 localhost
Take back the changes for this test if your sshd-chroot works successfully.
$ sudo rm /etc/xinetd.d/testssh
$ sudo killall -HUP xinetd
$ sudo vi /etc/services
Your ssh service does not chroot your user yet after this step.
Edit /usr/libexec/sshd-keygen-wrapper and change path to sshd.
#!/bin/ssh
[ ! -f /etc/ssh_host_key ] && ssh-keygen -q -t rsa1 -f /etc/ssh_host_key -N "" -C ""
[ ! -f /etc/ssh_host_rsa_key ] && ssh-keygen -q -t rsa -f /etc/ssh_host_rsa_key -N "" -C ""
[ ! -f /etc/ssh_host_dsa_key ] && ssh-keygen -q -t dsa -f /etc/ssh_host_dsa_key -N "" -C ""
#exec /usr/sbin/sshd $@
exec /usr/local/sbin/sshd-chroot $@
That's all. Replace is done.
Following example is for chrooting to /Users . It's considered using winscp and rsync. However any files might be missing. You have two commands (otool -L and ktrace) are very helpful to create chroot environment.
$ cd /Users
$ sudo mkdir -p bin etc usr/lib/system usr/libexec
$ sudo cp /bin/sh bin
$ sudo cp /bin/bash bin
$ sudo cp /bin/ls bin
$ sudo cp /bin/mkdir bin
$ sudo cp /bin/mv bin
$ sudo cp /bin/rm bin
$ sudo cp /bin/rmdir bin
$ sudo cp /bin/chmod bin
$ sudo cp /usr/bin/groups bin
$ sudo cp /usr/bin/rsync bin
$ cat /bin/cp > /tmp/cp
$ sudo cp /tmp/cp bin
$ sudo chmod 555 bin/cp
$ sudo cp /usr/lib/dyld usr/lib
$ sudo cp /usr/lib/libncurses.5.dylib usr/lib
$ sudo cp /usr/lib/libSystem.B.dylib usr/lib
$ sudo cp /usr/lib/libresolv.9.dylib usr/lib
$ sudo cp /usr/lib/libz.1.dylib usr/lib
$ sudo cp /usr/lib/libcrypto.0.9.7.dylib usr/lib
$ sudo cp /usr/lib/system/libmathCommon.A.dylib usr/lib/system
/etc/localtime is not essential, but it is necessary to display file timestamp in localtime when 'ls'.
$ ls -l /etc/localtime
lrwxr-xr-x 1 root wheel 30 20 Nov 2003 /etc/localtime -> /usr/share/zoneinfo/Asia/Tokyo
$ sudo cp /usr/share/zoneinfo/Asia/Tokyo etc/localtime
(note: If your host lives in any country other than Japan, the file you should copy is differ from me.)
Standard scp and sftp-server on Panther depend on too many files to use in chroot jail. So build new ones.
$ cd /your/favarite/place/
$ curl -O ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-3.9p1.tar.gz
$ tar zxvf openssh-3.9p1.tar.gz
$ cd openssh-3.9p1
$ ./configure; make
$ strip scp sftp-server
$ sudo cp scp /Users/bin
$ sudo cp sftp-server /Users/usr/libexec
The difference chroot or not is '/./' string in home directory. Create an account and change his home directory to /Users/./*. For example, /Users/./godzilla.
Change the home directory of your user you want to chroot.