Chroot in OpenSSH

bsdphx writes "OpenSSH developers Damien Miller and Markus Friedl have recently added a nifty feature to make life easier for admins. Now you can easily lock an SSH session into a chroot directory, restrict them to a built-in sftp server and apply these settings per user. And it's dead simple to do. If you need to allow semi-trusted people on your computers, then you want this bad!"

Why bother?

[whoever57]

Didn't we just read that chroot "jails" are not secure?

Re:Why bother?

[Anonymous Coward]

When has that ever stopped the OpenBSD/OpenSSH developers? Security is what they say it is.

Re:Why bother?

[bsdphx]

Understanding the issues is better than parroting what you've heard from random sources. Given the OpenBSD and OpenSSH track record for security it's obvious they have some serious clues about security.

Re:Oh thank god

[pembo13]

All we need now is some form of virtual user system that can be mapped to a real, unprivileged user, preferably with a flexible auth system.

Re:all that for sftp?

[evilviper]

WebDav with ApacheSSL properly installed is lots safer.

Why? No privilege separation. A MUCH bigger code base.

Not to mention fewer standalone programs.

IMHO there should never be user accounts on a machine,

Why not? The user security model is reliable and time tested. It does not require reinventing the "user". It does not depend on one program handling it's own system of virtual permissions correctly. It does not depend on the security of a large program that users directly interact with.

I can see ample reasons sftp is safer.