OpenSSH chroot patch for 5.1p1 To chroot a SSH user into home dir by using /./ example: ~# cat /etc/passwd | grep sn00p sn00p:x:10000:10000::/home/sn00p/./:/bin/bash patch source using: ~# cd /usr/src/openssh-5.1p1 ~# patch -p0 < /path/to/openssh-5.1p1-chroot.patch Original patch by Ricardo Cerqueira Updated for OpenSSH 5 by Mike Mueller ================================================================================ diff -u openssh-5.1p1/session.c.orig openssh-5.1p1/session.c --- openssh-5.1p1/session.c 2008-06-16 15:29:18.000000000 +0200 +++ session.c 2009-01-02 06:32:07.000000000 +0100 @@ -91,6 +91,8 @@ #include "monitor_wrap.h" #include "sftp.h" +#define CHROOT + #if defined(KRB5) && defined(USE_AFS) #include #endif @@ -1453,6 +1455,11 @@ { char *chroot_path, *tmp; +#ifdef CHROOT + char *user_dir; + char *new_root; +#endif /* CHROOT */ + #ifdef WITH_SELINUX /* Cache selinux status for later use */ (void)ssh_selinux_enabled(); @@ -1500,6 +1507,28 @@ exit(1); } endgrent(); + +#ifdef CHROOT + user_dir = xstrdup(pw->pw_dir); + new_root = user_dir + 1; + + while((new_root = strchr(new_root, '.')) != NULL) { + new_root--; + if(strncmp(new_root, "/./", 3) == 0) { + *new_root = '\0'; + new_root += 2; + + if(chroot(user_dir) != 0) + fatal("Couldn't chroot to user directory %s", user_dir); + + pw->pw_dir = new_root; + break; + } + new_root += 2; + } +#endif /* CHROOT */ + + # ifdef USE_PAM /* * PAM credentials may take the form of supplementary groups.