From owner-freebsd-questions@FreeBSD.ORG Wed May 4 16:37:06 2011 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 846F4106564A for ; Wed, 4 May 2011 16:37:06 +0000 (UTC) (envelope-from utisoft@gmail.com) Received: from mail-bw0-f54.google.com (mail-bw0-f54.google.com [209.85.214.54]) by mx1.freebsd.org (Postfix) with ESMTP id 04C8A8FC1C for ; Wed, 4 May 2011 16:37:05 +0000 (UTC) Received: by bwz12 with SMTP id 12so1619148bwz.13 for ; Wed, 04 May 2011 09:37:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :from:date:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=Qlcg8MmOzJXlB6WqRDc/bpq+pUkVt/4T8wUKLvLgwro=; b=KzwW7ObMuLGB7HsMqmj5ZdJ3eXaR4lzwOBg1M8VcTkyvKY6UsWjb7+UoWj5tIHpRkR tD/kOU62nx06lSKq4Wm2gfNwJebAhZ8+bL3ypxpfEJBoSNxqYp3QBxCE03C/DUvEX4cD e/LxLThVC73IS6FMI42Ei0J+v18SYuZKzBIBU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:reply-to:in-reply-to:references:from:date:message-id :subject:to:cc:content-type:content-transfer-encoding; b=A+nbwKxFqAwuVMLCs4v9aOFM/46N0FbF1/DRBbCn4YUkAO1AGKmMZJ4UcnSE9Slcwp HKAcoeMbGXtChy61U2/rdLEu22Su7+JDGsU3fG5cfoq37H8hgL3EE/NT96+mQE09RzY+ Os19j/FwLjkhjwtTh/dIpofHAKXuDPmgIFzNU= Received: by 10.204.81.203 with SMTP id y11mr129528bkk.124.1304527021096; Wed, 04 May 2011 09:37:01 -0700 (PDT) MIME-Version: 1.0 Received: by 10.204.42.21 with HTTP; Wed, 4 May 2011 09:36:10 -0700 (PDT) In-Reply-To: <20110504160459.GB5327@external.screwed.box> References: <07CAE521148F4E7392202CD6B031F504@jarasc430> <4DC139F7.9080109@infracaninophile.co.uk> <20110504160459.GB5327@external.screwed.box> From: Chris Rees Date: Wed, 4 May 2011 17:36:10 +0100 Message-ID: To: Peter Vereshagin Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: freebsd-questions@freebsd.org Subject: Re: Limitting SSH access X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: utisoft@gmail.com List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 May 2011 16:37:06 -0000 2011/5/4 Peter Vereshagin : > Wake me up when September ends, freebsd-questions! > 2011/05/04 16:47:33 +0100 Chris Rees =3D> To krad : > CR> > > > > Is it possible to limit the SSH access? > CR> > > Regarding ssh login, I usually use "rbash" from the ports, that > CR> restricts > CR> Or you could have a special /bin-restricted that you nullfs mount int= o > CR> ~userN/bin. > > > I personally should like to have a quick recipe on how to create such a l= imited > set of binaries ( libraries, mans, etc., each mounted with nullfs =A0read= -only to > every such a user's home ) from the 'world' build. > Some options like the rsync I consider to be a must in some cases so this > should include the ports availability, isn't it? > Hehe, big can of worms here. Plenty of opportunity to break out of a chroot, as well as the fact that it's largely discredited as a security mechanism [1]. Someone mentioned Jails earlier, probably a better idea. Chris [1] http://kerneltrap.org/Linux/Abusing_chroot