Hi,
I'm having a problem with openssh running a chroot sftp server. I've followed a couple of guides to the letter, but end up in a situation an sftp client connects, authenticates and then tries to cd $HOMEDIR but fails and disconnects. I ran this exact config on an older dist (a chaos calmer one) which worked fine. Does anyone know what am I missing?
System info
root@lundgw:/etc/ssh# cat /proc/version
Linux version 4.14.131 (buildbot@2ccc8102e0c3) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r7808-ef686b7292)) #0 SMP Thu Jun 27 12:18:52 2019
root@lundgw:/etc/ssh# sshd -v
sshd: unrecognized option: v
OpenSSH_7.7p1, OpenSSL 1.0.2s 28 May 2019
root@lundgw:/etc/ssh# opkg list-installed|grep openssh
openssh-client - 7.7p1-2
openssh-keygen - 7.7p1-2
openssh-server - 7.7p1-2
openssh-sftp-client - 7.7p1-2
openssh-sftp-server - 7.7p1-2
This is how I set up the user
root@lundgw:/# mkdir jail
root@lundgw:/# chown root:root jail
root@lundgw:/# cd jail
root@lundgw:/jail# mkdir testsftp
root@lundgw:/jail# useradd -U -d /testsftp -s /bin/false testsftp
root@lundgw:/jail# passwd testsftp
root@lundgw:/jail# chown testsftp:testsftp testsftp/
root@lundgw:/jail# chmod 700 testsftp/
This is how I setup the sshd
root@lundgw:/jail# cat /etc/ssh/sshd_config | grep -v -E ^#|grep -v -E ^$
Port 2022
AddressFamily inet
AllowUsers testsftp
LogLevel VERBOSE
PermitRootLogin no
RSAAuthentication yes
UsePrivilegeSeparation sandbox # Default for new installations.
Subsystem sftp internal-sftp
Match User testsftp
ChrootDirectory /jail/
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
This is what the client trying to connect will report
linus@lundgw:~$ sftp -P 2022 testsftp@theserver
testsftp@theserver's password:
Connected to testsftp@theserver.
Couldn't canonicalize: No such file or directory
Need cwd
Or if connecting using winscp I get
Error getting name of current remote directory. Cannot get real path for '.'. No such file or directory
Can't see much in the sshd log, but running on DEBUG3 I can at least see it successfully chroots:
Mon Sep 9 20:14:54 2019 auth.info sshd[20971]: User child is on pid 20973
Mon Sep 9 20:14:54 2019 auth.debug sshd[20973]: debug3: safely_chroot: checking '/'
Mon Sep 9 20:14:54 2019 auth.debug sshd[20973]: debug3: safely_chroot: checking '/jail/'
Mon Sep 9 20:14:54 2019 auth.debug sshd[20973]: debug3: safely_chroot: checking '/jail/'
Mon Sep 9 20:14:54 2019 auth.debug sshd[20971]: debug3: mm_request_receive entering
Mon Sep 9 20:14:54 2019 auth.debug sshd[20971]: debug1: do_cleanup
Tried running strace on the sshd process, but didn't get much smarter, extract below maybe says something to someone?
20984 close(46) = -1 EBADF (Bad file descriptor)
....
20984 close(1022) = -1 EBADF (Bad file descriptor)
20984 close(1023) = -1 EBADF (Bad file descriptor)
20984 chdir("/testsftp") = 0
20984 getpid() = 20984
20984 open("/proc/20984/fd", O_RDONLY|O_LARGEFILE|O_CLOEXEC|O_DIRECTORY) = -1 ENOENT (No such file or directory)
20984 prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=4*1024}) = 0
20984 close(3) = -1 EBADF (Bad file descriptor)
...
20984 close(1023) = -1 EBADF (Bad file descriptor)
20984 stat64("/etc/ssh/sshrc", 0xbeb0bdb0) = -1 ENOENT (No such file or directory)
20984 rt_sigaction(SIGPIPE, NULL, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, 8) = 0
20984 rt_sigaction(SIGPIPE, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0xb6f52d2c}, NULL, 8) = 0
20984 close(-1) = -1 EBADF (Bad file descriptor)
20984 close(-1) = -1 EBADF (Bad file descriptor)
20984 prctl(PR_SET_DUMPABLE, SUID_DUMP_DISABLE) = 0
20984 _newselect(2, [0], [], NULL, NULL) = 1 (in [0])
If I set ChrootDirectory / it works (but not much of a jail)
All I could was that I've tested many combinations of file permissions/home dirs/chroot jails, without any success.