Thursday, April 26, 2012

rssh chroot jail setup on CentOS 6 64bit

It took me hours to make rssh chroot jail work. There are some steps missing in the document of rssh. Here is how I made it work. I want to set up an account called "deployer" on host "chroot_host" to allow some of users remotely copy files under a directory under /app/platform using passwordless scp. I don't want any user log on the host using "deployer".
  1. Install rssh
  2. sudo yum install rssh
    
    rssh.x86_64                 2.3.3-2.el6.rf                  @rpmforge-el6-x86_64
    
  3. Edit /etc/rssh.conf
  4. # /etc/rssh.conf
    logfacility = LOG_USER 
    
    allowscp
    #allowsftp
    #allowcvs
    #allowrdist
    #allowrsync
    
    umask = 022
    
    chrootpath = /app/platform/chroot
    
    user=deployer:011:00001:/app/platform/chroot 
    
  5. Create the user deployer
  6. sudo /bin/groupadd builder
    sudo /sbin/useradd -g builder -s /usr/bin/rssh -d /app/platform deployer
    
  7. Create .ssh folder for deployer and add public keys to /app/platform/.ssh/authorized_keys
  8. sudo mkdir /app/platform/.ssh
    sudo cp id_rsa.pub /app/platform/.ssh/authorized_keys
    
  9. Create chroot jail
  10. sudo /usr/share/doc/rssh-2.3.3/mkchroot.sh /app/platform/chroot/
    
    NOTE: Must have "/", otherwise the script will create a folder "/app/platform/chroot."
  11. Create /dev/null
  12. sudo mknod -m 666 dev/null c 1 3
    
  13. Create bin and copy /bin/sh
  14. sudo mkdir /app/platform/chroot/bin
    sudo cp /bin/sh /app/platform/chroot/bin
    
  15. Copy all files in /lib64 to /app/platform/chroot/lib64
  16. sudo cp /lib64/* /app/platform/chroot/lib64
    
    NOTE: Some of lib files must not be used, but I don't know which files should be kept.
  17. Create home directory in chroot jail
  18. sudo mkdir /app/platform/chroot/home/deployer
    sudo chown deployer:builder /app/platform/chroot/home/deployer
    
  19. Edit jailed {{etc/password}} to change the home directory of deployer
  20. deployer:x:501:34075::/home/deployer:/usr/bin/rssh
    
  21. Then you can successfully scp a file to the repository
  22. scp a_file.xml deployer@chroot_host:/repository
    
    NOTE: Because we use chroot, the folder is /repository.
Here are the problems I encountered during the setup. Unfortunately, I don't know which step fix the problem.
  1. "lost connection" Anything is wrong you will get this error.
  2. "Couldn't open /dev/null: No such file or directory" After copying /bin/sh, got this error. mknod resolved this issue.
  3. "unknown user 501" After copying all files in /lib64/, it is gone
  4. "Could not chdir to home directory : No such file or directory" chroot/home/deployer is not created

Monday, April 9, 2012

Extract File from RPM

I failed to extract /etc/hue/log4j.properties from hue-common-1.2.0.0+114.20-1.x86_64.rpm because cpio prints out garbage data with something like this
[bewang@pmaster tmp]$ rpm2cpio hue-common-1.2.0.0+114.20-1.x86_64.rpm | cpio -idvm ./etc/hue/log4j.properties
cpio: warning: skipped 10263 bytes of junk
cpio: warning: archive header has reverse byte-order
cpio: premature end of file
It turns out that rpm2cpio outputs compressed data after googling this issue. I have to do like this:
rpm2cpio hue-common-1.2.0.0+114.20-1.x86_64.rpm | xz -d | cpio -idvm ./etc/hue/log4j.properties