sftp-server logging under chroot & privilege separation

[k***@chrysler.com]

Hello:

We are using OpenSSH 5.3p1.

We are using this to host an SFTP drop-box. We have implemented chroot &
privilege separation.

For corporate security reasons, we are running sshd as an application ID
setuid root (long story - don't want to go into it here)

The issue we are noting is that we 'lose' SFTP logging of commands when
sshd is run normally.

When we run it in DEBUG, we see the SFTP commands in the log.

We suspected the chrooting/priv sep had something to do with it, however,
changing the sftp-server to be setuid root did not fix the issue.

Any ideas?


Thanks


Kevin J. Herman
Sr. Systems Analyst
EBMX [Electronic Business Message eXchange]
ITM - Procurement Systems

T/L 776-6793
O/L [phone]
FAX [phone]

CTC E3000-3S2E8
CIMS 483-01-19
LOC/DEPT: 1100-1721

[Lars Nooden]

Post by k***@chrysler.com
We are using OpenSSH 5.3p1.
We are using this to host an SFTP drop-box. We have implemented chroot &
privilege separation.
... Any ideas?

Assuming the chroot is done via sshd_config and not the old way, here
are some things to look at:

+ turn off the SUID root - there is a way around whatever it was using
sudoer,
+ check that you have created a socket named /dev/log in the chroot
hierarchy,
+ check that syslogd, syslog-ng, or whathaveyou is using that socket,
+ check that the partition where the chroot directory resides is not
mounted with the nodev option.

"The ChrootDirectory must contain the necessary files
and directories to support the user's session ...
sessions which use logging do require /dev/log inside
the chroot directory

http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config


"Use of sftp-server in a chroot configuration therefore
requires that syslogd(8) establish a logging socket
inside the chroot directory.

http://www.openbsd.org/cgi-bin/man.cgi?query=sftp-server

Is that on Solaris, AIX, BSD or Linux?

Regards,
/Lars

[Robert Hajime Lanning]

It might be an issue with /dev/log not existing in the chrooted
environment.

If you are running syslog-ng, you could tell it to open a second
Unix domain dgram socket. ("unix-dgram(/chroot/path/dev/log);")

Post by k***@chrysler.com
We are using OpenSSH 5.3p1.
We are using this to host an SFTP drop-box.  We have implemented chroot &
privilege separation.
For corporate security reasons, we are running sshd as an application ID
setuid root (long story - don't want to go into it here)
The issue we are noting is that we 'lose' SFTP logging of commands when
sshd is run normally.
When we run it in DEBUG, we see the SFTP commands in the log.
We suspected the chrooting/priv sep had something to do with it, however,
changing the sftp-server to be setuid root did not fix the issue.
Any ideas?
Thanks
Kevin J. Herman
Sr. Systems Analyst
EBMX [Electronic Business Message eXchange]
ITM - Procurement Systems
T/L 776-6793
O/L [phone]
FAX [phone]
CTC E3000-3S2E8
CIMS 483-01-19
LOC/DEPT: 1100-1721

[k***@chrysler.com]

Hi Lars:

Thanks for the info.... we are running this on Solaris 9.

We are trying to stand up an OpenSSH SFTP server to integrate with our B2B
message hub. The Solaris SSH does not give us the flexibility we want to
run it.

The other problem we are having is that since we are an 'application
group', we are at the direction of the sys admins & corporate security for
how we need to implement this.

As for your points below:
==================

==> chrooting is being achieved via sshd_config

+ turn off the SUID root - there is a way around whatever it was using
sudoer
==> setuid is the only way we can get this to work
==> this is being run under a 'generic' application ID - NOT ROOT
+ check that you have created a socket named /dev/log in the chroot
hierarchy
==> I think this is my problem - I'll have to research this!!!
+ check that syslogd, syslog-ng, or whathaveyou is using that socket
==> we are using syslog -> root 5621 1 0 May 12 ? 66:05
/usr/sbin/syslogd


Thanks


Kevin J. Herman
Sr. Systems Analyst
EBMX [Electronic Business Message eXchange]
ITM - Procurement Systems

T/L 776-6793
O/L [phone]
FAX [phone]

CTC E3000-3S2E8
CIMS 483-01-19
LOC/DEPT: 1100-1721




Lars Nooden <***@gmail.com>
Sent by: ***@securityfocus.com
03/08/2010 05:46 PM

To
***@securityfocus.com
cc

Subject
Re: sftp-server logging under chroot & privilege separation

Post by k***@chrysler.com
We are using OpenSSH 5.3p1.
We are using this to host an SFTP drop-box. We have implemented chroot

&

Post by k***@chrysler.com
privilege separation.
... Any ideas?

Assuming the chroot is done via sshd_config and not the old way, here
are some things to look at:

+ turn off the SUID root - there is a way around whatever it was using
sudoer,
+ check that you have created a socket named /dev/log in the chroot
hierarchy,
+ check that syslogd, syslog-ng, or whathaveyou is using that socket,
+ check that the partition where the chroot directory resides is not
mounted with the nodev option.

"The ChrootDirectory must contain the necessary files
and directories to support the user's session ...
sessions which use logging do require /dev/log inside
the chroot directory

http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config


"Use of sftp-server in a chroot configuration therefore
requires that syslogd(8) establish a logging socket
inside the chroot directory.

http://www.openbsd.org/cgi-bin/man.cgi?query=sftp-server

Is that on Solaris, AIX, BSD or Linux?

Regards,
/Lars