Chroot SFTP on Solaris 10

Question

Hi everyone,
Does any know how to implement chrooted sftp on solaris 10? I found an very good articale about this on the internet -http://www.brandonhutchinson.com/chroot_ssh.html.
But it deals with ssh from the open source community(OpenSSH). The ssh on Solaris 10 is provided by Sun as shown below:
# pkginfo |grep -i ssh
system SUNWsshcu SSH Common, (Usr)
system SUNWsshdr SSH Server, (Root)
system SUNWsshdu SSH Server, (Usr)
system SUNWsshr SSH Client and utilities, (Root)
system SUNWsshu SSH Client and utilities, (Usr)
Could anyone shed a light on how to chroot the ssh/sftp provided by Sun?
Best regards,
Alex Lai

Answer 1

The key part is to have the devices you need: null and log, at a minimum.
You can't create devices in a local zone: mknod says "not owner". Doesn't matter whether you zlogin or ssh in.
Instead, create the devices from the global zone in your zone's filesystem. Create all your directories within the zone.
If you have zone foo with it's root /export/zone/foo and you have some home directory in the zone /export/home/chroot
cd /export/zone/foo/root/export/home/chroot/dev
mknod log c 21 5
mknod null c 13 5
(I'm assuming you have the same major/minor as in my system; verify first with ls -l /dev/log and ls -l /dev/null )