用scponly创建一个chroot环境的sftp

使用scponly可以使用户只能运行scp / sftp等命令,与rsync、subversion、gftp兼容,对winscp这个open source for Windows的client端支持很好.

scponly官网 http://sublimation.org/scponly/

服务器为as4 #wget http://nchc.dl.sourceforge.net/sourceforge/scponly/scponly-4.8.tgz #tar zxvf scponly-4.8.tgz #cd scponly-4.8 #./configure –prefix=/usr/local/scponly –enable-chrooted-binary –enable-winscp-compat –enable-sftp-logging-compat –enable-scp-compat –enable-rsync-compat –enable-passwd-compat #make #make install #echo /usr/local/scponly/sbin/scponlyc >> /etc/shells #make jail

/usr/bin/install -c -d /usr/local/scponly/bin /usr/bin/install -c -d /usr/local/scponly/man/man8 /usr/bin/install -c -d /usr/local/scponly/etc/scponly /usr/bin/install -c -o 0 -g 0 scponly /usr/local/scponly/bin/scponly /usr/bin/install -c -o 0 -g 0 -m 0644 scponly.8 /usr/local/scponly/man/man8/scponly.8 /usr/bin/install -c -o 0 -g 0 -m 0644 debuglevel /usr/local/scponly/etc/scponly/debuglevel if test “xscponlyc” != “x”; then                        \         /usr/bin/install -c -d /usr/local/scponly/sbin;              \         rm -f /usr/local/scponly/sbin/scponlyc;                 \         cp scponly scponlyc;                            \         /usr/bin/install -c -o 0 -g 0 -m 4755 scponlyc /usr/local/scponly/sbin/scponlyc;      \ fi chmod u+x ./setup_chroot.sh ./setup_chroot.sh   Next we need to set the home directory for this scponly user. please note that the user’s home directory MUST NOT be writeable by the scponly user. this is important so that the scponly user cannot subvert the .ssh configuration parameters.   for this reason, a writeable subdirectory will be created that the scponly user can write into.   Username to install [scponly] larry home directory you wish to set for this user [/home/larry] name of the writeable subdirectory [incoming] incoming ldconfig: /usr/lib/libmcrypt.so.4 is not a symbolic link     creating  /home/larry/incoming directory for uploading files   Your platform (Linux) does not have a platform specific setup script. This install script will attempt a best guess. If you perform customizations, please consider sending me your changes. Look to the templates in build_extras/arch.  – joe at sublimation dot org   please set the password for larry: Changing password for user larry. New UNIX password: BAD PASSWORD: it is too simplistic/systematic Retype new UNIX password: Sorry, passwords do not match New UNIX password: BAD PASSWORD: it is too simplistic/systematic Retype new UNIX password: passwd: all authentication tokens updated successfully. if you experience a warning with winscp regarding groups, please install the provided hacked out fake groups program into your chroot, like so: cp groups /home/larry/bin/groups

#ll /home/larry/ drwxr-xr-x  2 root  root  4096 11月 10 11:23 bin drwxr-xr-x  2 root  root  4096 11月 10 11:23 etc drwxr-xr-x  2 larry larry 4096 11月 10 11:26 incoming drwxr-xr-x  3 root  root  4096 11月 10 11:23 lib drwxr-xr-x  5 root  root  4096 11月 10 11:23 usr

larry用户登录后只能在incoming目录里传东西

创建新用户需在编辑目录里执行setup_chroot.sh #./setup_chroot.sh

#mkdir /home/larry/dev
#cp -a /dev/null /home/larry/dev/

64位系统
# mkdir /home/larry/lib64
# cp /lib64/ld-linux-x86-64.so.2 /home/larry/lib64/

参考:http://bbs.chinaunix.net/viewthread.php?tid=785820 http://hi.baidu.com/fengzhenjie/blog/item/2a4b1e7fe072ba0e29388a66.html