Score:0

Authentication with pub/priv key pair fails for chrooted users

ke flag

I'm trying to isolate certain users from other users, which requires the use of either virtualization or jailing. At the moment I've gone with jailing, which mostly works fine, except for a single problem: chrooted users are unable to use pub/priv key authentication.

As far as I understand, the SSH server works like this:

  1. Authenticate the user via priv/pub key pair by looking into $HOME/.ssh/authorized_keys and $HOME/.ssh/authorized_keys2.
  2. If no match, authenticate the user via password if allowed, otherwise fail.
  3. Jail the user into the chroot environment specified by ChrootDirectory.
  4. Create the specific shell environment.
  5. Move the user to $HOME if possible.

Since my $HOME is inside the chroot, is there a way to make this work that doesn't require soft-linking user directories into their expected non-chroot places? Below are my configuration files.

/etc/ssh/sshd_config

PermitRootLogin no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem       sftp    internal-sftp -f AUTH -l VERBOSE

Match Group problemusers
    ChrootDirectory /srv/chroot/users/
    X11Forwarding yes
    AllowTcpForwarding yes
    PermitTTY yes

/etc/schroot/chroot.d/problemusers.conf

[problemusers]
description=Debian Stable for problematic Users
type=directory
directory=/srv/chroot/users
root-users=uroot
users=uroot,amongus,srb2k

/etc/fstab

# System
UUID=a53ea27c-390d-4cbb-8fb1-ab152d42c335       none                            swap    sw                              0       0
UUID=fdcb2dd1-ca79-49f3-a226-81523665448c       /                               ext4    errors=remount-ro               0       1
UUID=68A0-5674                                  /boot/efi                       vfat    umask=0077                      0       1

# chroot: 'problemusers'
UUID=89fdd6a5-77b6-4333-8e19-2cfc93974368       /srv/chroot/users               btrfs   defaults                        0       1
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.