If you’re running a Linux, Mac OS X or Unix server of any description, SSH is an invaluable tool when it comes to taking control of the machine while you’re not infront of it.

In the world of web hosting, it’s also brings with it SFTP; a fantastic alternative to the very insecure FTP. Except it has one major flaw: by default on Ubuntu (and most Linux distros), one user can see all of another user’s files just by dropping up a directory to /home. Not exactly ideal if you’re providing a shared-hosting service.

So what we want is a chrooted version of SFTP. But this would also chroot SSH too, making it unusable for system administration. So we need to lock down SFTP only, but let SSH run free. We also want to be able to make some users SFTP-only (web hosting customers), and some users SFTP and SSH capable.

Luckily someone known as “The Minstrel”, came up with a pretty good solution to this. Back in November 2007, Mads Madsen also created a guide to this process for Debian/Ubuntu 7.04. This has been my favourite solution for some time now. The OpenSSH project has since created a version of this this idea internally, but annoyingly it’s got a major flaw: wherever you want to chroot the users to must be owned by root. In other words, users will not be able to create any files in the top level of their chroot jail.

Imagine that you have your users data stored in /home/username. You can’t chroot them to /home/username unless you create a directory inside there, and then let them own that. That gives them an ugly chrooted writable path like /htdocs (or whatever you choose to call it), and a / folder they can’t edit. The other option is to chroot them to /home, and let them own their homedir as normal, but then they can see every other user’s files. Again, not ideal.

So I stuck with The Minstrel’s version, but got tired of having to recompile and rebuild all this every time I wanted it on a new machine. Some people would have probably avoided this (actually quite good) solution altogether because it’s a bit too indepth. Well, it just got a bunch easier, because I created all the bits needed and am publishing them here for you to use.

Disclaimer: I make no promises that this won’t electrocute your cat, sleep with your girlfriend, make fun of your children, etc. Infact I make no promises about this at all. That said, for me, this has worked very well several times since Ubuntu 8.10′s release, on a whole variety of machines, and I’ve had no problems with it.

So from your Ubuntu machine, fire up a terminal (or SSH in, if you’re not sat infront of it) and paste this in:

wget http://unadopted.co.uk/openssh/openssh-server_5.1p1-3ubuntu1_i386.deb
sudo dpkg -i openssh-server_5.1p1-3ubuntu1_i386.deb
sudo aptitude hold openssh-server

This will download the modified package, install it, and tell Ubuntu not to replace it with new any of Ubuntu’s versions. Now bear in mind that you won’t get automatic security updates on OpenSSH anymore — you’ll need a new version of this package when OpenSSH 5.2 comes out, but when that comes out, it’ll be a pretty simple copy/paste job to upgrade, just like that was. The Minstrel notes that it’s worth signing up to the openssh-unix-announce mailing list to find out when this is necessary.

Now if this is the first time you’re doing this we need to do a couple extra steps (though you won’t need to do this if you’re just updating):

wget http://unadopted.co.uk/openssh/sftpsh
sudo cp sftpsh /bin/sftpsh
sudo chown root:root /bin/sftpsh
sudo chmod 755 /bin/sftpsh
sudo echo "/bin/sftpsh" >> /etc/shells 

This will download and install a special shell which you’ll need to set up as the login shell for the user accounts for whoever you want to lock down. This will kick them straight out if they try and SSH in, but will still let SFTP work. We also need to tell the system which directory to lock them into by adding a special tag into their home folder definition. Which all sounds a bit more complicated than it really is (it’s just one line to copy and paste).

So, let’s say our web user is called “mywebsite-sftp”. We’d just do this, if we wanted to lock them to their home directory:

sudo usermod -s /bin/sftpsh -d /home/mywebsite-sftp/./ mywebsite-sftp

Simple, right? The Minstrel has built up a pretty good set of FAQs incase you run into any problems.

If you ever change your mind, and want to go back to Ubuntu’s default OpenSSH server and undo all these changes, that’s dead simple too, just copy and paste this in (go-go-gadget uninstaller!):

sudo rm /bin/sftpsh
sudo aptitude remove openssh-server
sudo aptitude install openssh-server 

Warning: If you’re SSH’d in, don’t disconnect between the two aptitude commands, or you won’t have an SSH server to reconnect to (but it will stay alive until you disconnect). Also, you’ll need to remember that the sftpsh shell doesn’t exist anymore, though, and you’ll need to change any users back to a different shell using usermod.

Okay, so that’s that over with. Tell your friends, post it on Facebook, link to this in forum posts, Digg it, link to this from the Ubuntu Wiki, do whatever you feel you must do to share this with the world. :)

Bookmark to:

“As has been reported, we had staff cuts at LiveJournal Inc. this week. Early media reports seriously exaggerated the impact of the decision on the continued existence of LiveJournal as a company and misrepresented the scope of the staff cuts. The cuts were part of a restructuring that shifted global design and product development to the LiveJournal office in Moscow.”
– Press release in LiveJournal’s news community

This just reinforces to me that I made the correct decision by leaving, and slurping my data out. LiveJournal is dying slowly. The community aspect has completely gone. The company-user relations are now done by an anonymous user called “theljstaff”, as opposed to real people. It’s becoming about as much of a community as being a customer of BT — they’re turning into a service provider rather than a community.

Dumping LiveJournal and switching to WordPress was possibly one of the best decisions I’ve made regarding my journal/blog. Just as joining LiveJournal back in 2000 was one of the best decisions. This offer still stands if you want help leaving.

Related:
The post where I decided to leave LiveJournal, including my reasons why

Bookmark to:

“Most of us, of course, think we know what a depression looks like. Open a history book and the images will be familiar: mobs at banks and lines at soup kitchens, stockbrokers in suits selling apples on the street, families piled with all their belongings into jalopies. Families scrimp on coffee and flour and sugar, rinsing off tinfoil to reuse it and re-mending their pants and dresses. A desperate government mobilizes legions of the unemployed to build bridges and airports, to blaze trails in national forests, to put on traveling plays and paint social-realist murals.

Today, however, whatever a depression would look like, that’s not it. We are separated from the 1930s by decades of profound economic, technological, and political change, and a modern landscape of scarcity would reflect that.

What, then, would we see instead? And how would we even know a depression had started?”
read more…

A very interesting read…

Bookmark to:

“I know it is absurd to debate the rules of a reality that does not exist, but this genuinely irks me. You cannot kill a vampire with an MDF stake; werewolves can’t fly; zombies do not run. It’s a misconception, a bastardisation that diminishes a classic movie monster. The best phantasmagoria uses reality to render the inconceivable conceivable. The speedy zombie seems implausible to me, even within the fantastic realm it inhabits. A biological agent, I’ll buy. Some sort of super-virus? Sure, why not. But death? Death is a disability, not a superpower. It’s hard to run with a cold, let alone the most debilitating malady of them all.”
– Simon Pegg, The Guardian

I think it quite added to things like 28 Days Later, and the Resident Evil movies wouldn’t have been quite as action-movie as they were, but I have to agree. Bring back slow zombies!

Bookmark to:

Microsoft has only just decided that the official name for Windows 7 is going to be “Windows 7″, and is already calling it something else.

“So we decided to ship the Windows 7 code as Windows 6.1 – which is what you will see in the actual version of the product in cmd.exe or computer properties.”
– Mike Nash, The Windows Blog 

Bookmark to:

That was a bit weird.

I just ran into an unusual instance of Internet Explorer “doing things right” where Firefox is the non-compliant browser.

That doesn’t happen often. More here…

Bookmark to:

The bus driver this morning had gone through that energy efficient driving course that lots of bus companies are doing lately. Top speed? 15 mph or so for all of 10 seconds. Did it make and difference to my journey time? Actually, no. It seems to work, in London at least.

Bookmark to:

Minnie Ripperton, Deadmau5, and Soulwax in one DJ set? It could only be the next installment of the Unadopted Podcast, bubbling up and building until your ears almost pop. Get stuck in, turn it up loud, close your eyes, dance like an idiot, and don’t miss the incredible ending!

1. Röyksopp – Remind Me (DLake Remix v2)
2. The Ting Tings – That’s Not My Name (Doctor Werewolf Bmore Mix)
3. Minnie Ripperton vs Bambabounce – Loving You (DJ Yoda’s FabricLive.39 Bonus Beats Mix)
4. Soulwax – Miserable Girl (Nite Version)
5. Deadmau5 – Not Exactly
6. Justice – Phantom Pt2 (Soulwax Remix)

Listen now over at http://unadopted.co.uk/podcast/. If you haven’t already set it up, click the “Subscribe” link on the right-hand-side when you get there to get the podcast automatically delivered right into your iTunes or RSS reader whenever I release a new session!

Bookmark to: