Goltratec Blog

This is my first “How To” so i hope it’ll be able to help someone .

In order to set up the ssh enviroment, I used Jailkit. You can get it here.

Installation
After downloading it, compile and install it:

tar -zxvf jailkit-2.0.tar.gz

cd jailkit-2.0

./configure

make

sudo make install

Setting The “Jail” Up
After you’ve installed it, it’s time to set up the “root” directory (the directory to which the users will be jailed to).

sudo mkdir /jail

sudo chown root:root /jail

Creating the Proper Environment
The following lines will allow the logged in user to use whichever set of programs you won’t to allow:

sudo jk_init -v /jail basicshell
sudo jk_init -v /jail editors
sudo jk_init -v /jail extendedshell
sudo jk_init -v /jail netutils
sudo jk_init -v /jail ssh
sudo jk_init -v /jail sftp
sudo jk_init -v /jail jk_lsh

Creating and Jailing the User

sudo adduser thomas

sudo jk_jailuser -m -j /jail thomas

In /etc/passwd thomas’ line should look something like that:

thomas:x:1001:500::/jail/./home/thomas:/usr/sbin/jk_chrootsh

Don’t forget to set the password while you’re at it:

sudo passwd thomas

Setting Up the Home Directory
To the users logging in to this secured environment “/jail” will just show up as the “/” directory, so setting up a home directory is also needed:

sudo mkdir -p /jail/home/thomas

chown thomas:thomas /jail/home/thomas

Passwords
edit the /jail/etc/passwd and /jail/etc/group files with your favorite editor and add these lines (The numbers mentioned are the user and groups id, which you can check by opening the /etc/passwd file and look for the appropriate user):

sudo vi /jail/etc/group

paste and save this:
thomas:x:500:

sudo vi /jail/etc/passwd

paste and save this:
thomas:x:1001:500::/home/thomas:/bin/bash

One last thing:

sudo cp /home/trawler/.bashrc /jail/home/thomas

sudo chown thomas:thomas /jail/home/thomas/.bashrc

And that should do it!
you can check the configuration by “ssh’ing” your machine:

ssh thomas@localhost

And make sure everything’s ok.

If anything’s gone wrong /var/log/auth.log will give you the needed details:

tail /var/log/auth.log