1 --- openssh-3.7.1p2/servconf.c 2003-09-23 11:24:21.000000000 +0200
2 +++ openssh-3.7.1p2.pius/servconf.c 2003-10-07 20:49:08.000000000 +0200
5 /* Portable-specific options */
9 + options->use_chroot = -1;
11 /* Standard Options */
12 options->num_ports = 0;
13 options->ports_from_cmdline = 0;
15 if (options->use_pam == -1)
18 + if (options->use_chroot == -1)
19 + options->use_chroot = 0;
21 /* Standard Options */
22 if (options->protocol == SSH_PROTO_UNKNOWN)
23 options->protocol = SSH_PROTO_1|SSH_PROTO_2;
25 sBadOption, /* == unknown option */
26 /* Portable-specific options */
29 /* Standard Options */
30 sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
31 sPermitRootLogin, sLogFacility, sLogLevel,
34 { "usepam", sUnsupported },
37 + { "usechroot", sUseChroot },
39 + { "usechroot", sUnsupported },
41 { "pamauthenticationviakbdint", sDeprecated },
42 /* Standard Options */
45 intptr = &options->use_pam;
49 + intptr = &options->use_chroot;
52 /* Standard Options */
55 --- openssh-3.7.1p2/servconf.h 2003-09-02 14:58:22.000000000 +0200
56 +++ openssh-3.7.1p2.pius/servconf.h 2003-10-07 20:49:08.000000000 +0200
58 int max_startups_rate;
60 char *banner; /* SSH-2 banner message */
61 + int use_chroot; /* Enable chrooted enviroment support */
63 int client_alive_interval; /*
64 * poke the client this often to
65 --- openssh-3.7.1p2/session.c 2003-09-23 10:59:08.000000000 +0200
66 +++ openssh-3.7.1p2.pius/session.c 2003-10-07 20:49:08.000000000 +0200
67 @@ -1231,6 +1231,10 @@
69 do_setusercontext(struct passwd *pw)
76 if (getuid() == 0 || geteuid() == 0)
77 #endif /* HAVE_CYGWIN */
78 @@ -1268,6 +1272,28 @@
84 + if (options.use_chroot) {
85 + user_dir = xstrdup(pw->pw_dir);
86 + new_root = user_dir + 1;
88 + while((new_root = strchr(new_root, '.')) != NULL) {
90 + if(strncmp(new_root, "/./", 3) == 0) {
94 + if(chroot(user_dir) != 0)
95 + fatal("Couldn't chroot to user directory % s", user_dir);
96 + pw->pw_dir = new_root;
106 * PAM credentials may take the form of supplementary groups.
107 --- openssh-3.7.1p2/sshd_config 2003-09-02 14:51:18.000000000 +0200
108 +++ openssh-3.7.1p2.pius/sshd_config 2003-10-07 20:49:08.000000000 +0200
110 # bypass the setting of 'PasswordAuthentication'
113 +# Set this to 'yes' to enable support for chrooted user environment.
114 +# You must create such environment before you can use this feature.
117 #AllowTcpForwarding yes
120 --- openssh-3.7.1p2/sshd_config.0 2003-09-23 11:55:19.000000000 +0200
121 +++ openssh-3.7.1p2.pius/sshd_config.0 2003-10-07 20:49:08.000000000 +0200
123 CAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The de-
127 + Specifies whether to use chroot-jail environment with ssh/sftp,
128 + i.e. restrict users to a particular area in the filesystem. This
129 + is done by setting user home directory to, for example,
130 + /path/to/chroot/./home/username. sshd looks for a '.' in the
131 + users home directory, then calls chroot(2) to whatever directory
132 + was before the . and continues with the normal ssh functionality.
133 + For this to work properly you have to create special chroot-jail
134 + environment in a /path/to/chroot directory.
136 UseDNS Specifies whether sshd should lookup the remote host name and
137 check that the resolved host name for the remote IP address maps
138 back to the very same IP address. The default is ``yes''.
139 --- openssh-3.8p1/sshd_config.5.orig 2004-02-18 04:31:24.000000000 +0100
140 +++ openssh-3.8p1/sshd_config.5 2004-02-25 21:17:23.000000000 +0100
142 The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
143 LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
146 +Specifies whether to use chroot-jail environment with ssh/sftp, i.e. restrict
147 +users to a particular area in the filesystem. This is done by setting user
148 +home directory to, for example, /path/to/chroot/./home/username.
150 +looks for a '.' in the users home directory, then calls
152 +to whatever directory was before the . and continues with the normal ssh
153 +functionality. For this to work properly you have to create special chroot-jail
154 +environment in a /path/to/chroot directory.
156 Specifies whether the system should send TCP keepalive messages to the