I'm trying to isolate certain users from other users, which requires the use of either virtualization or jailing. At the moment I've gone with jailing, which mostly works fine, except for a single problem: chrooted users are unable to use pub/priv key authentication.
As far as I understand, the SSH server works like this:
- Authenticate the user via priv/pub key pair by looking into
$HOME/.ssh/authorized_keys
and $HOME/.ssh/authorized_keys2
.
- If no match, authenticate the user via password if allowed, otherwise fail.
- Jail the user into the chroot environment specified by
ChrootDirectory
.
- Create the specific shell environment.
- Move the user to
$HOME
if possible.
Since my $HOME is inside the chroot, is there a way to make this work that doesn't require soft-linking user directories into their expected non-chroot places? Below are my configuration files.
/etc/ssh/sshd_config
PermitRootLogin no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem sftp internal-sftp -f AUTH -l VERBOSE
Match Group problemusers
ChrootDirectory /srv/chroot/users/
X11Forwarding yes
AllowTcpForwarding yes
PermitTTY yes
/etc/schroot/chroot.d/problemusers.conf
[problemusers]
description=Debian Stable for problematic Users
type=directory
directory=/srv/chroot/users
root-users=uroot
users=uroot,amongus,srb2k
/etc/fstab
# System
UUID=a53ea27c-390d-4cbb-8fb1-ab152d42c335 none swap sw 0 0
UUID=fdcb2dd1-ca79-49f3-a226-81523665448c / ext4 errors=remount-ro 0 1
UUID=68A0-5674 /boot/efi vfat umask=0077 0 1
# chroot: 'problemusers'
UUID=89fdd6a5-77b6-4333-8e19-2cfc93974368 /srv/chroot/users btrfs defaults 0 1