HOWTO: Jailed SFTP on CentOS 5.4 64 bit

[aaronfaby]

Took me two days to get this working, so I thought I'd post it here to save someone else the time.

This tutorial assumes you are using SSH jails per this URL:

http://help.directadmin.com/item.php?id=90

On CentOS 5.4 64 bit, the SFTP functionality is broken. To fix that, you need to edit some files in /usr/local/directadmin/custombuild/jail.

The first file is files.list. Add these lines to the file (anywhere, doesn't matter):

/usr/lib64/libnss3.so
/usr/lib64/libnss_db.so
/usr/lib64/libnss_files.so
/usr/lib64/libnss_ldap.so
/usr/lib64/libnss_nisplus.so
/usr/lib64/libnssutil3.so
/usr/lib64/libnss_compat.so
/usr/lib64/libnss_dns.so
/usr/lib64/libnss_hesiod.so
/usr/lib64/libnss_nis.so
/usr/lib64/libnssckbi.so
/lib64/libnss_compat-2.5.so
/lib64/libnss_db-2.2.so
/lib64/libnss_dns-2.5.so
/lib64/libnss_files-2.5.so
/lib64/libnss_hesiod-2.5.so
/lib64/libnss_ldap-2.5.so
/lib64/libnss_nis-2.5.so
/lib64/libnss_nisplus-2.5.so
/lib64/libnss_compat.so.2
/lib64/libnss_db.so.2
/lib64/libnss_dns.so.2
/lib64/libnss_files.so.2
/lib64/libnss_hesiod.so.2
/lib64/libnss_ldap.so.2
/lib64/libnss_nis.so.2
/lib64/libnss_nisplus.so.2

Next, edit the file jail_user.sh. Near the beginning of the file you will notice these lines:

mkdir -p $USER_HOME/etc
mkdir -p $USER_HOME/bin
mkdir -p $USER_HOME/usr/bin

Directly above these lines, add the following:

mkdir -p $USER_HOME/dev
mknod $USER_HOME/dev/null c 1 3
chown $1:$1 $USER_HOME/dev/null

And we're done. Any users you jailed previously will have to have their environment rebuilt which is done easily by running the script manually:

./jail_user.sh username

Any new users will now have working SFTP functionality.

 

[scsi]

Whats the reason for needing sftp over scp.

 

[aaronfaby]

Whats the reason for needing sftp over scp.

Because most user applications don't support scp but they support sftp.