Linked by Thom Holwerda on Wed 25th Apr 2007 10:15 UTC, submitted by FreeRhino
"Jailing is a mechanism to virtually change a system's root directory. By employing this method, administrators can isolate services so that they cannot access the real filesystem structure. You should run unsecured and sensitive network services in a chroot jail, because if a hacker can break into a vulnerable service he could exploit your whole system. If a service is jailed, the intruder will be able to see only what you want him to see - that is, nothing useful. Some of the most frequent targets of attack, which therefore should be jailed, are BIND, Apache, FTP, and SSH. SSHjail is a patch for the OpenSSH daemon. It modifies two OpenSSH files (session.c and version.h) and allows you to jail your SSH service without any need for SSH reconfiguration."
Thread beginning with comment 233860
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
Member since:
2006-10-12
Jailed SSH sessions are typically used as a replacement for chroot FTP: allowing SCP, SFTP or rsync access to just a jailed area of a server for up/downloads, and nothing else.
This sort of patch is a Good Thing, because it helps put the nail in the coffin of FTP (and not a moment too soon).