chrooted ssh and grsec

[polarfox]

Hello,

I tried to run chrooted SSH, but I cant connect to that ssh daemon because of this message in kern.log:

Code: Select all

Feb 26 21:14:50 alus kernel: grsec: From 192.168.1.2: denied attempt to double chroot to /chroot/ministerija/var/run/sshd by (sshd:14373) UID(0) EUID(0), parent (sshd:563) UID(0) EUID(0)


Just cant find how to fix this. Can anybody help?
Thanks

[siti]

In the menuconfig of the kernel configuration -> GrSecurity -> Filesystem Protections -> Deny double-chroots (make sure this option is disabled).

[polarfox]

Thanks.

Maybe there is some other way to override kernel grsec settings for double chroot without recompiling kernel?

[sig]

If you have enabled sysctl support in grsec section in kernel config, you can disable double chroot:

Code: Select all

echo 0 > /proc/sys/kernel/grsecurity/chroot_deny_chroot

Although this doesn't work if you have enabled /proc/sys/kernel/grsecurity/grsec_lock (the value is set to 1).

[raphinou]

I think you can also disable privilege separation in the sshd config.

Raph