[gentoo-server] chrooted ssh related scripts WAS: users of virtual domains

Hi ,
my scripts may not be usefull for everyone but I hope it would be a good
inspiration at least.
I have my chrooted env in /home/alcatraz/
there is one more useful tip - set up owner of /home/alcatraz/home/ to
root:apache with privileges 751 and it allows apache read user folders but
users cant read even list of other users folders.

Here are the simple scripts I use:
refresh_chroot:
#!/bin/bash

cp /lib/libresolv.so.2 /home/alcatraz/lib/
cp /lib/libutil.so.1 /home/alcatraz/lib/
cp /lib/libnsl.so.1 /home/alcatraz/lib/
cp /lib/libcrypt.so.1 /home/alcatraz/lib/
cp /lib/libc.so.6 /home/alcatraz/lib/
cp /lib/libdl.so.2 /home/alcatraz/lib/
cp /lib/ld-linux.so.2 /home/alcatraz/lib/
cp /usr/lib/libcrypto.so.0.9.7 /home/alcatraz//usr/lib/
cp /usr/lib/libz.so.1 /home/alcatraz/usr/lib/

cp /usr/lib/misc/sftp-server /home/alcatraz/usr/lib/misc/


cp /bin/bash /home/alcatraz/bin/
cp /bin/cp /home/alcatraz/bin/
cp /bin/ls /home/alcatraz/bin/
cp /bin/rm /home/alcatraz/bin/
cp /bin/rmdir /home/alcatraz/bin/
cp /bin/mkdir /home/alcatraz/bin/
cp /bin/mv /home/alcatraz/bin/

cp /lib/librt.so.1 /home/alcatraz/lib/
cp /lib/libpthread.so.0 /home/alcatraz/lib/

create_new_user:
#!/bin/bash

echo "username: "
read user
echo "pass: "
read password
echo "subdomain: "
read subdomain
echo "main domain: "
read domena

CHROOT="/home/alcatraz/./home"

#add user
groupadd $user
useradd -d "$CHROOT/$user/" -s /bin/bash -g $user $user
echo "$user:$password" > /root/tmp-soubor
/usr/sbin/chpasswd < /root/tmp-soubor
rm -f /root/tmp-soubor
echo "$user:$password" >> /root/notes/pamet
mkdir "$CHROOT/$user/"
chown $user "$CHROOT/$user/"
chmod 754 "$CHROOT/$user/"

echo "wil he have apache?"
read apache

# ********************* add apache virtual server
if [ $apache = "y" ]; then

    chown "$user:apache" "$CHROOT/$user/"
    mkdir "$CHROOT/$user/webroot/"
    echo "Zdravi <b>$user</b>" > $CHROOT/$user/webroot/index.html
    chown $user:apache $CHROOT/$user/webroot -R

    #add DNS record
    echo "$subdomain CNAME   $domena." >> /etc/bind/pri/$domena.dns
    reload-dns # tady bych mel i precist SN souboru pro NAMED a zmenit ho,
ale nevim jak :-(

    #add apache log files
    LOGS="$CHROOT/$user/logs"
    mkdir $LOGS
    chown 755 $LOGS
    echo "zacatek" > $LOGS/access_log
    chmod 644 $LOGS/access_log
    echo "zacatek" > $LOGS/error_log
    chmod 644 $LOGS/error_log

    #add apache record

    SOUBOR="/etc/apache2/conf/vhosts/$subdomain.$domena.vhost"
    echo "<VirtualHost $domena:80>"  >> $SOUBOR
    echo "  ServerName $subdomain.$domena" >> $SOUBOR
    echo "  DocumentRoot $CHROOT/$user/webroot" >> $SOUBOR
    echo "  CustomLog $LOGS/access_log combined" >> $SOUBOR
    echo "  ErrorLog $LOGS/error_log" >> $SOUBOR
    echo "</VirtualHost>" >> $SOUBOR

    /root/bin/apache-reload
fi;

echo "Will he have mail domain?"
read email

# ********************** add maildomain
if [ "$email" = "y" ]; then
    /home/vpopmail/bin/vadddomain -q -d /home/vpopmail $subdomain.$domena
postmaster $password
fi;

echo "MySQL?"
read mysql

# ********************** add mysql
if [ $mysql = "y" ]; then
echo "create database $user;" > /root/tmp-soubor
echo "GRANT ALL PRIVILEGES ON $user.* TO $user@localhost IDENTIFIED BY
'$password' WITH GRANT OPTION;" >> /root/tmp-soubor
echo "FLUSH PRIVILEGES;" >> /root/tmp-soubor
mysql -pR1o5o9T < /root/tmp-soubor
rm -f /root/tmp-soubor
fi;

cp /etc/passwd /home/alcatraz/etc/passwd -f
chmod 600 /home/alcatraz/etc/passwd


> I would be interested in the scripts for chroot setup, etc.
> Regards,
> -John
>
> gentoo@××××××.com wrote:
>
>> Hi,
>> I think, that better solution is chrootssh (it also have switch in
>> openssh
>> ebuild). I've used it for a year or so and it works well. I can send you
>> some scripts I use along with it (for copying libs to chroot and
>> creating
>> users).
>> Petr
>>
>>
>>
>>
>>>Ben Munat wrote:
>>>
>>>>So, my question is, is there a way to restrict her user's movements in
>>>>the file system? It would be nice if she were only able to work within
>>>>her home directory.
>>>
>>>Best is to set up a chroot environment in which the user will work.
>>>I think a good starting point is jailkit @
>>>http://olivier.sessink.nl/jailkit/
>>>I already have an ebuild for it in my overlay @
>>>http://gentoo.mirror.at.stealer.net/portage_overlay/app-admin/jailkit/
>>>
>>>Package contains a shell which will jail the user into a specific
>>>directory. Contains also tools to copy programs and depending libraries
>>>into the chroot environment.
>>>
>>>Sven
>>>
>>
>>
>
>