OpenSSH (GNU/Linux) chroot patch for openssh-5.3p1 To chroot a SSH session into ~/ by using /./ in homedir path example: ~# useradd -d /home/sn00p/./ sn00p ~# cat /etc/passwd | grep sn00p sn00p:x:10000:10000::/home/sn00p/./:/bin/bash download & unpack the source: ~# cd /usr/src ~# wget http://anga.funkfeuer.at/ftp/pub/OpenBSD/OpenSSH/portable/openssh-5.3p1.tar.gz ~# tar zxf openssh-5.3p1.tar.gz download patch & apply to source: ~# cd /usr/src/openssh-5.3p1 ~# wget http://www.cybnet.ch/misc/opensource/openssh-5.3p1-chroot.patch ~# patch -p0 < openssh-5.3p1-chroot.patch configure (options for GNU/Debian) & compile: ~# ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam ~# make Original patch by Ricardo Cerqueira Updated for OpenSSH 5 by Mike Mueller ==================================================================================== diff -u session.c.orig session.c --- session.c.orig 2009-10-03 19:54:45.000000000 +0200 +++ session.c 2009-10-03 19:57:42.000000000 +0200 @@ -1,4 +1,4 @@ -/* $OpenBSD: session.c,v 1.246 2009/04/17 19:23:06 stevesk Exp $ */ +/* $OpenBSD: session.c,v 1.246-sn0 2009/04/17 19:23:06 stevesk Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved @@ -91,6 +91,8 @@ #include "monitor_wrap.h" #include "sftp.h" +#define CHROOT + #if defined(KRB5) && defined(USE_AFS) #include #endif @@ -1457,6 +1459,11 @@ { char *chroot_path, *tmp; +#ifdef CHROOT + char *user_dir; + char *new_root; +#endif + #ifdef WITH_SELINUX /* Cache selinux status for later use */ (void)ssh_selinux_enabled(); @@ -1499,6 +1506,27 @@ exit(1); } endgrent(); + +#ifdef CHROOT + user_dir = xstrdup(pw->pw_dir); + new_root = user_dir + 1; + + while((new_root = strchr(new_root, '.')) != NULL) { + new_root--; + if (strncmp(new_root, "/./", 3) == 0) { + *new_root = '\0'; + new_root += 2; + + if (chroot(user_dir) != 0) + fatal("Couldn't chroot to user directory %s", user_dir); + + pw->pw_dir = new_root; + break; + } + new_root += 2; + } +#endif + # ifdef USE_PAM /* * PAM credentials may take the form of supplementary groups.