lloyd_b said: Type "man chroot" in a terminal window - the chroot command is what programs like ftp daemons use to hide all but selected parts of the system from the user.
The first step in implementing it is to provide links, within the user's home directory, to directories that they will need access to. For example, they'll need "/bin" (in order to run "bash"), "/tmp" (for temp files), and pretty much the entire "/usr" directory tree (for everything else). Symbolic links will NOT work from within a chroot, so you'll either need hard links (which will not work across file systems), or use the remount capability of the "mount" command.
Once that's done, you just need to execute the chroot command to lock them in.
Here's a rough sample of a script:
mount --bind /bin /home/username/bin
mount --bind /tmp /home/username/tmp
mount --bind /usr /home/username/usr
chroot /home/username /bin/bash
Create this script in the "/bin" directory. Call it "lockin". Set its permissions to 755 (-rwxr-xr-x), so that everyone can execute it, but only root can modify it.
Then, create the "bin" "tmp" and "usr" mount points (directories) in the user's home directory.
Finally, in "/etc/passwd", change the user's default shell ("/bin/bash") to the script above ("/bin/lockin").
There are quite a few "gotcha's" with using chroot. For instance, depending on how you filesystems are configured you may need to use "mount --rbind..." instead of "mount --bind", and the directories I've included may or may not be enough (again, depending on exactly what the users use, and how things are configured), so if you want to try this, plan on spending some time tinkering to get it configured correctly.
Lloyd B.
Hello Lloyd I followed your instructions precisely but the chroot shell doesnt work. The user (in my case) is called "owner" and when logging into this account, I am still able to navigate above the /home/owner directory, into other users home directories.
Here's what I tried: created a script using the ubuntu text editor: mount --bind /bin /home/username/bin mount --bind /tmp /home/username/tmp mount --bind /usr /home/username/usr chroot /home/owner /bin/bash
..placed it into /bin , named "lockin" (no quotes of course. ..set the permissions to 755 and chmod it to root:root
Then changed the /etc/passwd line to: /bin/lockin
Then logged in, but no avail of chroot.
Then I went on and chnged the script to use --rbind instead:
mount --rbind /bin /home/username/bin mount --rbind /tmp /home/username/tmp mount --rbind /usr /home/username/usr chroot /home/owner /bin/bash
.. but still, the user account still functions as if there were no restrictions at all
PS: I did reboot after each change, just to make sure.
Any ideas ??
Thx