Ansible Role ssh_chroot_jail

This role helps manage a simple SSH chroot jail.

GitHub	Version	Issues	Pull Requests	Downloads

Example Playbook

Here’s a sample playbook taken from molecule/default/converge.yml that is tested for every update.

---
- name: Converge
  hosts: all
  become: true

  vars:
    ssh_chroot_l2chroot_path: /usr/bin/l2chroot
    ssh_chroot_jail_users:
      - name: foo
        home: /home/foo
        shell: /bin/bash

  roles:
    - role: buluma.ssh_chroot_jail

You need to prepare the machine using molecule/default/prepare.yml:

---
- name: Prepare
  hosts: all
  become: yes
  gather_facts: no

  roles:
    - role: buluma.bootstrap

For a complete guide on using these roles, check out this link.

Role Variables

The default variable values are in defaults/main.yml:

---
ssh_chroot_jail_path: /var/jail

ssh_chroot_jail_group_name: ssh_jailed

ssh_chroot_jail_users: []

ssh_chroot_jail_dirs:
  - bin
  - dev
  - etc
  - lib
  - lib64
  - usr/bin
  - usr/lib
  - usr/lib64
  - home

ssh_chroot_jail_devs:
  - {dev: 'null', major: '1', minor: '3'}
  - {dev: 'random', major: '5', minor: '0'}
  - {dev: 'urandom', major: '1', minor: '5'}
  - {dev: 'zero', major: '1', minor: '8'}

ssh_chroot_tmpfiles_conf_path: /etc/tmpfiles.d/ssh-chroot.conf

ssh_chroot_bins:
  - /bin/cp
  - /bin/sh
  - /bin/bash
  - /bin/ls
  - /bin/rm
  - /bin/cat
  - /bin/grep
  - /bin/sed
  - /bin/chmod
  - /bin/chown
  - /bin/ed
  - /bin/nano
  - /usr/bin/tail
  - /usr/bin/head
  - /usr/bin/awk
  - /usr/bin/wc
  - /usr/bin/sort
  - /usr/bin/uniq
  - /usr/bin/cut
  - /usr/bin/scp
  - /usr/bin/tee
  - /usr/bin/touch
  - /usr/bin/vim
  - /usr/bin/vi
  - /usr/bin/dircolors
  - /usr/bin/tput
  - /usr/bin/free
  - /usr/bin/top
  - /usr/bin/find
  - /usr/bin/id
  - /usr/bin/whoami
  - /usr/bin/groups

ssh_chroot_l2chroot_template: l2chroot.j2
ssh_chroot_l2chroot_path: /usr/local/bin/l2chroot

ssh_chroot_copy_extra_items:
  - /etc/hosts
  - /etc/passwd
  - /etc/group
  - /etc/ld.so.cache
  - /etc/ld.so.conf
  - /etc/nsswitch.conf

ssh_chroot_sshd_chroot_jail_config: |
  Match group {{ ssh_chroot_jail_group_name }}
      ChrootDirectory {{ ssh_chroot_jail_path }}
      X11Forwarding no
      AllowTcpForwarding no

ssh_chroot_jail_dirs_recurse: true

Requirements

• Python packages listed in requirements.txt.

State of Used Roles

The following roles are used to get the system ready. You can also use different methods.

Requirement	GitHub	Version
buluma.bootstrap

Context

This role is part of many compatible roles. For more information, check the documentation for these roles.

Here’s a visual of related roles:

Compatibility

This role has been tested on these container images:

You need Ansible version 2.12 or higher. Tests have been run on:

• The previous version.
• The current version.
• The development version.

If you encounter problems, please report them on GitHub.

Changelog

See the Role History.

License

This project is licensed under Apache-2.0.

Author Information

Created by Shadow Walker.