[scponly] Relative listing outside scponlyc chroot jail allowed?

[Jan Mazáč]

On 22.9.2007, at 17:44, Kaleb Pederson wrote:

[snip]

> If this works on mac, what output does it give:
>
> getent passwd SomeUser

getent: command not found :( I tried quickly to google some  
equivalent but found nothing.


> Also, what do the permissions on scponly/scponlyc look like:
>
> ls -l /opt/local/{bin,sbin}/scponly*

ls -l from install location:
-rwsr-xr-x   1 root  wheel  37008 Sep 18 16:06 /opt/local/sbin/scponlyc
-rwxr-xr-x   1 root  wheel  37008 Sep 18 16:06 /opt/local/bin/scponly

ls -l scponlyc from inside chroot:
-rwxr-xr-x   1 root  SomeGroup  37008 Sep 21 12:46 /Users/SomeUser/ 
Sites/usr/local/sbin/scponlyc


[snip]

> Can you paste for us the clientside transcript of the details.  Eg;
>
> $ sftp user at host
> sftp> ls /
> /bin   /dev   /etc   /home  /lib   /usr
> sftp> ls
> /bin   /dev   /etc   /home  /lib   /usr
> sftp> ls ..
> ... some output here...

sftp SomeUser at some.host.com
Connecting to some.host.com...
SomeUser at some.host.com's password:
sftp> ls
Streaming           somesite.com     dev                 images
index.html          usr
sftp> ls /
/Streaming          /somesite.com    /dev                /images
/index.html         /usr
sftp> ls ..
../Desktop      ../Documents    ../Library      ../Movies       ../Music
../Pictures     ../Public       ../Sites
sftp> quit


[snip]

> What I said isn't exactly useful if you configured scponly exactly  
> as stated
> in that article because you won't have a program that can act as a  
> shell nor
> the ls program installed.
>
> In theory you can copy your shell to the chroot (with any necessary  
> libraries)
> and copy the 'ls' command to the chroot and then do something like  
> this:
>
> $ sudo chroot -u SomeUser /Users/SomeUser/Sites/ /bin/bash
> $ ls
> [blah]
> $ ls /
> [blah2]
> $ ls ..
> [blah3]
>
> The above should pretty much have the same system calls as the sftp  
> ls output,
> although perhaps not exactly the same.

I have scponlyc present inside the /usr/local/sbin directory inside  
the chroot but not the ls binary. Still if I try to execute commands  
like "sudo chroot -u SomeUser /Users/SomeUser/Sites/ /usr/local/sbin/ 
scponlyc" without any error I'm immediately returned to prompt. This  
is inside my chroot:


/usr/
/usr/lib/
/usr/lib/system/
/usr/libexec/
/usr/local/sbin/
/dev/


drwxr-xr-x   5 root      coming2s   170 Sep 21 12:46 usr/

	drwxr-xr-x   11 root  SomeGroup  374 Sep 21 12:46 lib/

		-r-xr-xr-x   1 root  SomeGroup  1688500 Sep 21 12:46 dyld
		-r-xr-xr-x   1 root  SomeGroup  8000260 Sep 21 12:46 libSystem.B.dylib
		-rwxr-xr-x   1 root  SomeGroup  2279820 Sep 21 12:46 libcrypto. 
0.9.7.dylib
		-rw-r--r--   1 root  SomeGroup   251320 Sep 21 12:46 libgcc_s.1.dylib
		-r-xr-xr-x   1 root  SomeGroup   364660 Sep 21 12:46 libmx.A.dylib
		-rw-r--r--   1 root  SomeGroup   553300 Sep 21 12:46 libncurses. 
5.dylib
		-r-xr-xr-x   1 root  SomeGroup   314056 Sep 21 12:46 libresolv.9.dylib
		-rwxr-xr-x   1 root  SomeGroup   332256 Sep 21 12:46 libz.1.dylib
		drwxr-xr-x   3 root  SomeGroup      102 Sep 21 12:46 system/

			-r-xr-xr-x   1 root  SomeGroup  108428 Sep 21 12:46  
libmathCommon.A.dylib

	drwxr-xr-x    3 root  SomeGroup  102 Sep 21 12:46 libexec/

		-rwxr-xr-x 1 root SomeGroup 44188 Sep 21 12:46 sftp-server

	drwxr-xr-x    3 root  SomeGroup  102 Sep 21 12:46 local/

		drwxr-xr-x 3 root SomeGroup 102 Sep 21 12:46 sbin/

			-rwxr-xr-x 1 root SomeGroup 37008 Sep 21 12:46 scponlyc

drwxr-xr-x   3 root      coming2s   102 Sep 21 12:49 dev/

	crw-rw-rw-   1 root  SomeGroup    1,   3 Sep 21 12:50 null


> Lastly, unless there is something surprising in the things I've  
> asked you to
> provide, we still won't have any answers, so I would need you to go  
> through
> the tracing process outlined here:
>
> http://sublimation.org/scponly/wiki/index.php/FAQ#I_still_can. 
> 27t_find_my_problem.2C_what_else_can_I_try.3F
>
[snip]

I already looked into that but it is giving me hard time. I only  
found so far that ktrace is tool to use on OS X. I will post output  
as soon as I get one.


Jan


::: jan mazáč ::: www.hifi-web.com ::: +420 603 295 975 :::

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2415 bytes
Desc: not available
Url : https://lists.ccs.neu.edu/pipermail/scponly/attachments/20070923/5d0faef8/attachment.bin