nano /etc/ssh/sshd_config

#Subsystem sftp /usr/libexec/openssh/sftp-server
Subsystem sftp internal-sftp

Voor alle gebruikers in een groep

Match Group developers
  ChrootDirectory %h
  # ChrootDirectory /home/%u
  # ForceCommand internal-sftp
  AllowTcpForwarding no

Of voor een specifieke gebruiker

Match User david
   ChrootDirectory %h
   # ChrootDirectory /home/%u
   # ForceCommand internal-sftp

Let op: De volgende instelling moet uit staan anders wordt de verbinding verbroken na het inloggen via SSH

# ForceCommand internal-sftp

---

SSH deamon opnieuw starten

service sshd restart

---

Een groep aanmaken

groupadd developers

Gebruiker toevoegen aan een groep

usermod -G developers <username>

Overzicht van leden in een groep

grep developers /etc/group

---

mknod -m 666 /home/<username>/dev/null c 1 3
chmod 666 /home/<username>/dev/null

mknod -m 666 /home/<username>/dev/zero c 1 3
chmod 666 /home/<username>/dev/zero

mkdir /home/<username>/dev/pts
mount --bind /dev/pts /home/<username>/dev/pts

mknod -m 666 /home/<username>/dev/tty c 5 0

---

cd /home/<username>
nano create_chroot_env.sh

#!/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

APPS="/bin/bash /bin/cat /bin/cp /bin/false /bin/grep /bin/ln /bin/ls /bin/mkdir /bin/more /bin/mv /bin/ping /bin/pwd /bin/rm /bin/rmdir /bin/sh /bin/touch /bin/true /bin/vi /usr/bin/du /usr/bin/groups /usr/bin/head /usr/bin/id /usr/bin/less /usr/bin/scp /usr/bin/tail /usr/bin/svn /usr/bin/svnadmin /usr/bin/svndumpfilter /usr/bin/svnlook /usr/bin/svnserve /usr/bin/svnsync /usr/bin/svnversion"

for prog in $APPS;  do
        mkdir -p ./`dirname $prog` > /dev/null 2>&1
        cp $prog ./$prog
        # obtain a list of related libraries
        ldd $prog > /dev/null
        if [ "$?" = 0 ] ; then
                LIBS=`ldd $prog | awk '{ print $3 }'`
                for l in $LIBS; do
                        mkdir -p ./`dirname $l` > /dev/null 2>&1
                        cp $l ./$l  > /dev/null 2>&1
                done
        fi
done

chmod 755 create_chroot_env.sh
./create_chroot_env.sh

---

chmod u+s /home/<username>/bin/ping
setcap cap_net_raw+ep /home/<username>/bin/ping

---

mkdir /home/<username>/etc/
cp /etc/hosts /home/<username>/etc/
cp /etc/resolv.conf /home/<username>/etc/

---

cp /lib64/ld-linux-x86-64.so.2 /home/<username>/lib64/
cp /lib64/libnss_dns.so.2 /home/<username>/lib64/

---

Write failed: Broken pipe

tail -f /var/log/secure

fatal: bad ownership or modes for chroot directory "/home/david"

chown root /home/<username>

error: /dev/pts/1: No such file or directory

mkdir /home/<username>/dev/pts
mount --bind /dev/pts /home/<username>/dev/pts

error: open /dev/tty failed - could not set controlling tty: No such file or directory

mknod -m 666 /home/<username>/dev/tty c 5 0

/bin/sh: No such file or directory

cp /bin/sh /home/<username>/bin
cp /lib64/ld-linux.so.2 /home/<username>/lib64

unknown host domain.tld

cp /lib64/libnss_dns.so.2 /home/<username>/lib64/

icmp open socket: Operation not permitted

chmod u+s /home/<username>/bin/ping
setcap cap_net_raw+ep /home/<username>/bin/ping

---

Zie ook: CentOS - Installatie van vsftpd met chroot | CentOS - De home directory van een gebruiker wijzigen | CentOS - Een gebruiker toevoegen