Ssh | @sskaje - Page 2

By @sskaje
Link: https://sskaje.me/2015/05/ssh-chroot-jails/

为了不给各种仅使用ssh tunnel的人访问vps的信息，把SSH的chroot jail配好了。

准备工作

假定Chroot根目录为 /var/jail, 定义为

# JAILROOT=/var/jail

1	# JAILROOT=/var/jail

添加用户组

# groupadd sshusers

1	# groupadd sshusers

配置sshd_config

修改 /etc/ssh/sshd_config 添加下列配置

Match group sshusers
          ChrootDirectory /var/jail/
          X11Forwarding yes
          AllowTcpForwarding yes
          GatewayPorts yes
          PermitOpen any
          PermitTunnel yes

Match group sshusers

ChrootDirectory /var/jail/

X11Forwarding yes

AllowTcpForwarding yes

GatewayPorts yes

PermitOpen any

PermitTunnel yes

创建Jail

其实不创建也行，客户端ssh时开-N就好

/var/jail
/var/jail/etc
/var/jail/etc/nsswitch.conf
/var/jail/etc/hosts
/var/jail/etc/ld.so.cache
/var/jail/etc/resolv.conf
/var/jail/etc/ld.so.conf
/var/jail/lib
/var/jail/lib/x86_64-linux-gnu
/var/jail/lib/x86_64-linux-gnu/libnss_dns.so.2
/var/jail/lib/x86_64-linux-gnu/libnss_hesiod.so.2
/var/jail/lib/x86_64-linux-gnu/libselinux.so.1
/var/jail/lib/x86_64-linux-gnu/libpthread.so.0
/var/jail/lib/x86_64-linux-gnu/libdl.so.2
/var/jail/lib/x86_64-linux-gnu/libattr.so.1
/var/jail/lib/x86_64-linux-gnu/libnss_files-2.19.so
/var/jail/lib/x86_64-linux-gnu/liblzma.so.5
/var/jail/lib/x86_64-linux-gnu/libnss_compat-2.19.so
/var/jail/lib/x86_64-linux-gnu/libc.so.6
/var/jail/lib/x86_64-linux-gnu/libpcre.so.3
/var/jail/lib/x86_64-linux-gnu/libnss_nisplus-2.19.so
/var/jail/lib/x86_64-linux-gnu/libnss_compat.so.2
/var/jail/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
/var/jail/lib/x86_64-linux-gnu/libgcc_s.so.1
/var/jail/lib/x86_64-linux-gnu/libz.so.1
/var/jail/lib/x86_64-linux-gnu/libtinfo.so.5
/var/jail/lib/x86_64-linux-gnu/libresolv.so.2
/var/jail/lib/x86_64-linux-gnu/libnss_dns-2.19.so
/var/jail/lib/x86_64-linux-gnu/libnss_nis.so.2
/var/jail/lib/x86_64-linux-gnu/libcom_err.so.2
/var/jail/lib/x86_64-linux-gnu/libkeyutils.so.1
/var/jail/lib/x86_64-linux-gnu/libnss_nis-2.19.so
/var/jail/lib/x86_64-linux-gnu/libacl.so.1
/var/jail/lib/x86_64-linux-gnu/libnss_nisplus.so.2
/var/jail/lib/x86_64-linux-gnu/libm.so.6
/var/jail/lib/x86_64-linux-gnu/libnss_hesiod-2.19.so
/var/jail/lib/x86_64-linux-gnu/libnss_files.so.2
/var/jail/usr
/var/jail/usr/lib
/var/jail/usr/lib/libbind9.so.90
/var/jail/usr/lib/x86_64-linux-gnu
/var/jail/usr/lib/x86_64-linux-gnu/libkrb5support.so.0
/var/jail/usr/lib/x86_64-linux-gnu/libk5crypto.so.3
/var/jail/usr/lib/x86_64-linux-gnu/libGeoIP.so.1
/var/jail/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2
/var/jail/usr/lib/x86_64-linux-gnu/libkrb5.so.3
/var/jail/usr/lib/x86_64-linux-gnu/libstdc++.so.6
/var/jail/usr/lib/x86_64-linux-gnu/libxml2.so.2
/var/jail/usr/lib/liblwres.so.90
/var/jail/usr/lib/libisccfg.so.90
/var/jail/usr/lib/libdns.so.100
/var/jail/usr/lib/libisc.so.95
/var/jail/usr/bin
/var/jail/usr/bin/dig
/var/jail/usr/bin/telnet
/var/jail/dev
/var/jail/dev/null
/var/jail/home
/var/jail/home/sskaje
/var/jail/lib64
/var/jail/lib64/ld-linux-x86-64.so.2
/var/jail/bin
/var/jail/bin/bash
/var/jail/bin/ls
/var/jail/bin/cat

/var/jail

/var/jail/etc

/var/jail/etc/nsswitch.conf

/var/jail/etc/hosts

/var/jail/etc/ld.so.cache

/var/jail/etc/resolv.conf

/var/jail/etc/ld.so.conf

/var/jail/lib

/var/jail/lib/x86_64-linux-gnu

/var/jail/lib/x86_64-linux-gnu/libnss_dns.so.2

/var/jail/lib/x86_64-linux-gnu/libnss_hesiod.so.2

/var/jail/lib/x86_64-linux-gnu/libselinux.so.1

/var/jail/lib/x86_64-linux-gnu/libpthread.so.0

/var/jail/lib/x86_64-linux-gnu/libdl.so.2

/var/jail/lib/x86_64-linux-gnu/libattr.so.1

/var/jail/lib/x86_64-linux-gnu/libnss_files-2.19.so

/var/jail/lib/x86_64-linux-gnu/liblzma.so.5

/var/jail/lib/x86_64-linux-gnu/libnss_compat-2.19.so

/var/jail/lib/x86_64-linux-gnu/libc.so.6

/var/jail/lib/x86_64-linux-gnu/libpcre.so.3

/var/jail/lib/x86_64-linux-gnu/libnss_nisplus-2.19.so

/var/jail/lib/x86_64-linux-gnu/libnss_compat.so.2

/var/jail/lib/x86_64-linux-gnu/libcrypto.so.1.0.0

/var/jail/lib/x86_64-linux-gnu/libgcc_s.so.1

/var/jail/lib/x86_64-linux-gnu/libz.so.1

/var/jail/lib/x86_64-linux-gnu/libtinfo.so.5

/var/jail/lib/x86_64-linux-gnu/libresolv.so.2

/var/jail/lib/x86_64-linux-gnu/libnss_dns-2.19.so

/var/jail/lib/x86_64-linux-gnu/libnss_nis.so.2

/var/jail/lib/x86_64-linux-gnu/libcom_err.so.2

/var/jail/lib/x86_64-linux-gnu/libkeyutils.so.1

/var/jail/lib/x86_64-linux-gnu/libnss_nis-2.19.so

/var/jail/lib/x86_64-linux-gnu/libacl.so.1

/var/jail/lib/x86_64-linux-gnu/libnss_nisplus.so.2

/var/jail/lib/x86_64-linux-gnu/libm.so.6

/var/jail/lib/x86_64-linux-gnu/libnss_hesiod-2.19.so

/var/jail/lib/x86_64-linux-gnu/libnss_files.so.2

/var/jail/usr

/var/jail/usr/lib

/var/jail/usr/lib/libbind9.so.90

/var/jail/usr/lib/x86_64-linux-gnu

/var/jail/usr/lib/x86_64-linux-gnu/libkrb5support.so.0

/var/jail/usr/lib/x86_64-linux-gnu/libk5crypto.so.3

/var/jail/usr/lib/x86_64-linux-gnu/libGeoIP.so.1

/var/jail/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2

/var/jail/usr/lib/x86_64-linux-gnu/libkrb5.so.3

/var/jail/usr/lib/x86_64-linux-gnu/libstdc++.so.6

/var/jail/usr/lib/x86_64-linux-gnu/libxml2.so.2

/var/jail/usr/lib/liblwres.so.90

/var/jail/usr/lib/libisccfg.so.90

/var/jail/usr/lib/libdns.so.100

/var/jail/usr/lib/libisc.so.95

/var/jail/usr/bin

/var/jail/usr/bin/dig

/var/jail/usr/bin/telnet

/var/jail/dev

/var/jail/dev/null

/var/jail/home

/var/jail/home/sskaje

/var/jail/lib64

/var/jail/lib64/ld-linux-x86-64.so.2

/var/jail/bin

/var/jail/bin/bash

/var/jail/bin/ls

/var/jail/bin/cat

添加用户

# USERNAME=sskaje
# usermod -G sshusers -a $USERNAME
# mkdir $JAILROOT/home/$USERNAME
# chown $USERNAME: $JAILROOT/home/$USERNAME

# USERNAME=sskaje

# usermod -G sshusers -a $USERNAME

# mkdir $JAILROOT/home/$USERNAME

# chown $USERNAME: $JAILROOT/home/$USERNAME

SSH Chroot jails by @sskaje: https://sskaje.me/2015/05/ssh-chroot-jails/

Incoming search terms:

silverv98

By @sskaje
Link: https://sskaje.me/2015/04/%e8%8b%b1%e6%96%87osx-terminal-ssh%e6%97%a0%e6%b3%95%e8%be%93%e5%85%a5%e4%b8%ad%e6%96%87/

新电脑系统用了英文。
安装了两台debian 7的开发机，SSH上去之后发现Bash下中文输入不了，输入完成后Terminal会闪一下，输入不成功，但是vim里可以。
对比其他的VPS、服务器，CentOS，Ubuntu都一切正常。

为了排除字体，locale的可能，把中文字体装了，中文的locale也全加上了，依旧输入不了。

直到我想到这篇文章，然后退出SSH，本地看了眼这个session下的locale

LANG=
LC_COLLATE="C"
LC_CTYPE="UTF-8"
LC_MESSAGES="C"
LC_MONETARY="C"
LC_NUMERIC="C"
LC_TIME="C"
LC_ALL=

LANG=

LC_COLLATE="C"

LC_CTYPE="UTF-8"

LC_MESSAGES="C"

LC_MONETARY="C"

LC_NUMERIC="C"

LC_TIME="C"

LC_ALL=

执行

export LC_ALL=en_US.UTF-8

1	export LC_ALL=en_US.UTF-8

就好了

英文OSX Terminal SSH无法输入中文 by @sskaje: https://sskaje.me/2015/04/%e8%8b%b1%e6%96%87osx-terminal-ssh%e6%97%a0%e6%b3%95%e8%be%93%e5%85%a5%e4%b8%ad%e6%96%87/

Tag: ssh

SSH Chroot jails

准备工作

添加用户组

配置sshd_config

创建Jail

Incoming search terms:

英文OSX Terminal SSH无法输入中文

ssh_exchange_identification: Connection closed by remote host

Incoming search terms: