I'm using NFSv4 and used following /etc/exports on Server (lets say, xx.xx.xx.x0):
/var/www/html/project xx.xx.xx.x101(rw)
/var/www/html/project xx.xx.xx.x102(rw)
And each Client is showing something like below, when i check mount:
xx.xx.xx.x0:/var/www/html/project on /var/www/html/project type nfs (rw,vers=4,addr=xx.xx.xx.x0,clientaddr=xx.xx.xx.x101)
But when i check into the mounted directory ls -laZ (with Z option), it is showing like:
drwxrwxrwx. 11 user1 user1 ? 4.0K Mar 9 02:36 .
drwxr-xr-x. 26 user1 user1 ? 4.0K Mar 8 18:17 ..
drwxrwxrwx. 9 user1 user1 ? 4.0K Sep 3 2012 wp-admin
drwxrwxrwx. 8 user1 user1 ? 4.0K Dec 12 09:47 wp-content
drwxrwxrwx. 8 user1 user1 ? 4.0K Oct 16 12:04 wp-includes
-rwxrwxr--. 1 user1 user1 ? 647 Mar 8 18:54 .htaccess
-rwxrwxr--. 1 user1 user1 ? 395 Dec 12 09:49 index.php
-rwxrwxrwx. 1 user1 user1 ? 20K Dec 12 09:49 license.txt
-rwxrwxrwx. 1 user1 user1 ? 9.0K Dec 12 09:49 readme.html
The problems are the ? Question Marks, which i believe is showing wrong File Security Context Values.
Any good idea on it please?
Note: SELinux is disabled, on every machines.
i got it by myself that i realized SELinux on Clients, was blocking the Security Context Permissions whilst NFS Server is totally disabling the SELinux. So i disable the SELinux on this Client machines and rebooted, then the exactly the same File/Directory Security Contexts are showing on all ends.
Related
I was able to connect to my school server via SSH. I had an assignment in which I was supposed to use the touch command to create a new file. Yet it keeps returning permission denied. Others were able to do the same thing. Though why do I keep getting this error?
Below is what was the input from the terminal.
Last login: Tue Aug 23 09:16:18 on ttys000
Dominiks-Air:~ fsociety95$ ssh djaneka1#navajo.dtcc.edu
djaneka1#navajo.dtcc.edu's password:
Last login: Tue Aug 23 09:16:35 2016 from pool-72-94-210-193.phlapa.fios.verizon.net
Navajo is Linux shell server provided to staff, faculty, and students. The
operating system is RedHat Enterprise Linux 5.
Alpine, a Pine replacement, has been provided as a mail client. Run "pine"
at the command prompt.
This server also provides web space to users. Web pages can be stored in
the ~/www directory. This is also accessible by mapping a drive in Windows
to \navajo\homepage. The URL for your homepage is
http://user.dtcc.edu/~username/.
Your home directory is also accessible in Windows by mapping to
\navajo\.
If something appears broken or missing, please email path#dtcc.edu.
Could not chdir to home directory /u/d/j/djaneka1: No such file or directory
-bash-3.2$ touch today
touch: cannot touch `today': Permission denied
-bash-3.2$ pwd
/
-bash-3.2$ touch today
touch: cannot touch `today': Permission denied
-bash-3.2$
Edit: here is the result of ls -al
-bash-3.2$ ls -al
total 204
drwxr-xr-x 25 root root 4096 Aug 22 16:50 .
drwxr-xr-x 25 root root 4096 Aug 22 16:50 ..
-rw-r--r-- 1 root root 0 Aug 3 14:01 .autofsck
-rw-r--r-- 1 root root 0 Jan 30 2009 .autorelabel
-rw------- 1 root root 2050 Aug 3 14:00 .bash_history
drwxr-xr-x 2 root root 4096 May 4 04:14 bin
drwxr-xr-x 4 root root 3072 Aug 3 13:57 boot
drwxr-xr-x 11 root root 4060 Aug 3 14:02 dev
drwxr-xr-x 87 root root 12288 Aug 23 10:05 etc
drwxr-xr-x 3 root root 4096 Oct 1 2009 home
drwxr-xr-x 13 root root 12288 Jun 1 04:09 lib
drwx------ 2 root root 16384 Mar 24 2008 lost+found
drwxr-xr-x 3 root root 4096 Oct 1 2009 media
drwxr-xr-x 2 root root 0 Aug 3 14:02 misc
drwxr-xr-x 4 root root 4096 May 26 2012 mnt
drwxr-xr-x 2 root root 0 Aug 3 14:02 net
drwxr-xr-x 9 root root 4096 Jan 5 2009 nsr
drwxrwxr-x 3 root root 4096 Oct 12 2015 opt
dr-xr-xr-x 219 root root 0 Aug 3 14:01 proc
drwxr-x--- 12 root root 4096 Apr 22 10:06 root
drwxr-xr-x 2 root root 12288 Aug 4 04:02 sbin
drwxr-xr-x 2 root root 4096 Oct 1 2009 selinux
drwxr-xr-x 2 root root 4096 Oct 1 2009 srv
drwxr-xr-x 11 root root 0 Aug 3 14:01 sys
drwxrwxrwt 38 root root 4096 Aug 23 10:07 tmp
drwxr-xr-x 34 root root 4096 Jun 21 08:29 u
drwxr-xr-x 14 root root 4096 Apr 16 2010 usr
drwxr-xr-x 24 root root 4096 Apr 16 2010 var
-rw------- 1 root root 2865 Dec 16 2008 .viminfo
-bash-3.2$
EDIT:
Here is what I see after trying touch today in /home
So to try and create a new document in the root directory you need to be recognised as root. That means using the sudo command.
However for that you would need a password that you may not have. If you do perfect. But in any case I would not recommend adding files to the root directory.
Instead try the following:
cd home
touch today
This should work just fine and answer your question.
Still if you need/want to create today in your root directory try the following
sudo touch today
You will then be prompted for the root password that you can type (if you have it obviously)
In any case I suggest reading this which may be very helpful for you.
I wonder if this was ever truly answered.
If I was looking at it, I would try to see what the system thinks is the home directory of djaneka1, since it may have been setup partway and not completed, leaving stuff owned by root that should have been owned by djaneka1.
If you use the pwd command, and get back the "/" (root) directory there is something wrong with your setup.
The message: Could not chdir to home directory /u/d/j/djaneka1: No such file or directory
tells you it can't find your home directory.
-bash-3.2$ pwd
/
the command "pwd" revealing "/" is just an artifact of the system not being able to find your home directory.
To find what the system thinks is one's home directory,
one can search the file named '/etc/passwd' for one's login name.
I expect this is a possible result if you do that:
$ fgrep 'djaneka1' /etc/passwd
djaneka1:x:1505:1506::/u/d/j/djaneka1:/bin/bash
since it complained that it couldn't find that directory.
This needs to be fixed by someone who has more rights to the system, like root.
there is nothing djaneka1 can do a
I'd like to think I'm not a linux noob but I am having an issue I can't explain. I hope it something stupid. I have an external drive that I am trying to set up on plex. It was originally formatted ntfs but I shrunk the partition and made another ext4 partition. Plex can't look into the drive and see the folders. I have been trying to change the perms but they aren't sticking. They don't stick if
myUser#mint /media/myUser $ ls -lah
total 44K
drwxr-x---+ 6 root root 4.0K Oct 24 11:21 .
drwxr-xr-x 3 root root 4.0K Oct 24 10:50 ..
drwx------ 1 myUser myUser 20K Oct 14 07:27 DataDisk
myUser#myUserMint /media/myUser $ sudo chmod -R 766 DataDisk/
[sudo] password for myUser:
myUser#mint /media/myUser $ ls -lah
total 44K
drwxr-x---+ 6 root root 4.0K Oct 24 11:21 .
drwxr-xr-x 3 root root 4.0K Oct 24 10:50 ..
drwx------ 1 myUser myUser 20K Oct 14 07:27 DataDisk
myUser#mint /media/myUser $
Am I missing something obvious or is this just weird?
I want to add public key authorization to my sftp chroot directory but I allways get:
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/test/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).
Couldn't read packet: Connection reset by peer
Chroot works because authorization with password is possible.
I have other account on this host without chroot and it works with this key.
I tried many times, but still it doesn't work.
On server in auth.log there is only:
Connection closed by xxx [preauth]
This is my directory:
ls -laR /sftp/
/sftp/:
total 12
drwxr-xr-x 3 root root 4096 May 3 16:55 .
drwxr-xr-x 23 root root 4096 May 3 14:46 ..
drwxr-xr-x 3 root root 4096 May 3 16:45 backup
/sftp/backup:
total 12
drwxr-xr-x 3 root root 4096 May 3 16:45 .
drwxr-xr-x 3 root root 4096 May 3 16:55 ..
drwxr-xr-x 3 backup sftpusers 4096 May 3 16:55 incoming
/sftp/backup/incoming:
total 12
drwxr-xr-x 3 backup sftpusers 4096 May 3 16:55 .
drwxr-xr-x 3 root root 4096 May 3 16:45 ..
drwx------ 2 backup sftpusers 4096 May 3 21:06 .ssh
/sftp/backup/incoming/.ssh:
total 12
drwx------ 2 backup sftpusers 4096 May 3 21:06 .
drwxr-xr-x 3 backup sftpusers 4096 May 3 16:55 ..
-rw------- 1 backup sftpusers 391 May 3 21:06 authorized_keys
My user:
backup:x:1002:1003::/incoming:/usr/sbin/nologin
My ssh config:
Match Group sftpusers
ChrootDirectory /sftp/%u
AuthorizedKeysFile /sftp/backup/incoming/.ssh/authorized_keys
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
Please help.
I attempted this solution (putting AuthorizedKeysFile into the Match block) and sshd -T complains:
/etc/ssh/sshd_config line 153: Directive 'AuthorizedKeysFile' is not allowed within a Match block
(RHEL 6.6, openssh 5.3p1-104)
SOLUTION: The authorized_keys file (and the user's .ssh directory) must exist in the home directory location defined by /etc/passwd, outside of the chroot directory.
For example (using the OP usernames/uids):
/etc/passwd:
backup:x:1002:1003::/home/backup:/sbin/nologin
Create directory /home/backup, owned by root
Create directory /home/backup/.ssh, change ownership to backup, chmod 700 /home/backup/.ssh
Copy the authorized_keys file to /home/backup/.ssh, chmod 400 authorized_keys
ls -laR /home
/home:
total 12
drwxr-xr-x 3 root root 4096 Jul 9 12:25 .
drwxr-xr-x 3 root root 4096 Sep 22 2014 ..
drwxr-xr-x 3 root root 4096 Jul 9 12:25 backup
/home/backup:
total 12
drwxr-xr-x 3 root root 4096 Jul 9 12:25 .
drwxr-xr-x 3 root root 4096 Jul 9 12:25 ..
drwx------ 3 backup sftpusers 4096 Jul 9 12:28 .ssh
/home/backup/.ssh:
total 12
drwx------ 3 backup sftpusers 4096 Jul 9 12:28 .
drwxr-xr-x 3 root root 4096 Jul 9 12:25 ..
-r-------- 3 backup sftpusers 391 Jul 9 12:29 authorized_keys
/etc/ssh/sshd_config becomes:
Match Group sftpusers
ChrootDirectory /sftp/%u
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
The chroot directory structure is then:
ls -laR /sftp/
/sftp/:
total 12
drwxr-xr-x 3 root root 4096 May 3 16:55 .
drwxr-xr-x 23 root root 4096 May 3 14:46 ..
drwxr-xr-x 3 root root 4096 May 3 16:45 backup
/sftp/backup:
total 12
drwxr-xr-x 3 root root 4096 May 3 16:45 .
drwxr-xr-x 3 root root 4096 May 3 16:55 ..
drwxr-xr-x 3 backup sftpusers 4096 May 3 16:55 incoming
drwxr-xr-x 3 root root 4096 May 3 16:55 home
/sftp/backup/incoming:
total 12
drwxr-xr-x 3 backup sftpusers 4096 May 3 16:55 .
drwxr-xr-x 3 root root 4096 May 3 16:45 ..
/sftp/backup/home:
total 12
drwxr-xr-x 3 root root 4096 May 3 16:55 .
drwxr-xr-x 3 root root 4096 May 3 16:45 ..
drwx------ 2 backup sftpusers 4096 May 3 21:06 backup
/sftp/backup/home/backup:
total 12
drwx------ 3 backup sftpusers 4096 May 3 21:06 .
drwxr-xr-x 3 root root 4096 May 3 16:55 ..
Note: /sftp/backup/home/backup is empty, it's only there to provide a path that will look like the non-chroot /home/backup -- the .ssh directory is /home/backup/.ssh not /sftp/backup/home/backup/.ssh
Problem resolved.
I have changed it:
AuthorizedKeysFile /sftp/backup/incoming/.ssh/authorized_keys
to:
AuthorizedKeysFile /sftp/%u/.ssh/authorized_keys
Stephen Buchanan's answer (which works around RHEL6's inability to set AuthorizedKeys in a Match block) splits keys into /home and contents into /sftp, but it is possible to keep everything together under /home instead.
You do this by creating the user's chroot under their home directory. For example, in sshd_config, set the chroot to /home/<user>/sftp:
Match Group sftphome
ChrootDirectory /home/%u/sftp
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
As before, ensure /home/<user> is owned by root and place .ssh keys in /home/<user>/.ssh such that the user has read permissions. Now create /home/<user>/sftp/home/<user>, with all directories owned by root except for the last <user>, which should be owned by the user. Finally, ensure the user's home directory is /home/<user> in /etc/passwd.
Now when the user logs in, the ssh key is looked up in /home/<user>/.ssh as per /etc/passwd, a chroot is done into /home/<user>/sftp, and then a cd is done into /home/<user> inside the chroot. In other words, the user's remote working directory will appear as /home/<user>.
You can optionally bind mount directories under /home/<user>/sftp/home/<user>, or anywhere under /home/<user>/sftp (which is / from the user's point of view).
It's possible to omit the sftp/ directory, create /home/<user>/home/<user> and chroot into /home/<user>, but this can be confusing as the .ssh directory and any other files will show up for the user in their /. The sftp/ directory keeps things clean.
Note: In practice, if a user's home directory is missing, sftp will normally just cd into /. You could abuse this property by not creating /home/<user> inside the chroot, so the user starts in / instead of /home/<user>. This is a bit fragile, but could come in handy.
You need to add AuthorizedKeysFile /sftp/%u/.ssh/authorized_keys in your /etc/ssh/sshd_config file. It is better if you added it in the match block.
I am currently creating an application that requires separate users running duplicate programs. They cannot run under root because of security reasons, so they are initiated by a Java app that I am working on, and I am starting them with runuser -l. However, I cannot cd into a directory, even though it is owned by the user, and the user has 770 permissions in the folder.
Here's what I'm running:
runuser -l lp1 -c 'java \-jar /root/Desktop/workspace/LitePanel/servers/server1/server.jar \-Xms1024M nogui'
And the output of this is:
runuser: warning: cannot change directory to /root/Desktop/workspace/LitePanel/bin/servers/server1/: Permission denied
Here's an ls -all:
drwxr-xr-x. 3 root root 4096 Jan 30 14:03 .
drwxr-xr-x. 7 root root 4096 Jan 30 14:02 ..
drwxrwx---. 2 lp1 lp1 4096 Jan 31 03:07 server1
Inside the directory:
drwxrwx---. 2 lp1 lp1 4096 Jan 31 03:07 .
drwxr-xr-x. 3 root root 4096 Jan 30 14:03 ..
-rwxrwx---. 1 lp1 lp1 9170551 Jan 31 03:07 server.jar
And here's /etc/passwd:
lp1:x:501:501::/root/Desktop/workspace/LitePanel/bin/servers/server1/:/bin/false
Anyone know why this is happening? It looks like the user has the necessary permissions to do this.
You have said that the directory itself has permissions 770 and is owned by the user, but what about its parents? I believe the cd command will need at least read access (and possibly execute) on the parent directories.
I am trying to setup my webserver so that one group will have access to the files. Apache and every user that needs to edit the files will be part of this group. So I've set all the files to have the group psacln. I've added psacln to my groups. But it still won't let me view the files:
[tom#166 httpdocs]$ whoami
tom
[tom#166 httpdocs]$ groups tom
tom : tom adm wheel apache psacln andy
[tom#166 httpdocs]$ ls -al
ls: .: Permission denied
[tom#166 httpdocs]$ sudo ls -al
total 92
d---rwx--- 14 andy psacln 4096 Jul 22 17:51 .
drwxrwxr-x 16 apache apache 4096 Jul 21 09:29 ..
d---rwx--- 4 andy psacln 4096 Jul 21 09:26 backend
d---rwx--- 3 andy psacln 4096 Jul 22 15:21 core
d---rwx--- 5 andy psacln 4096 Jul 21 09:26 css
...
One thing that may be useful to note, is that when you change a user's group membership, you will have to log out and back in again (i.e. group memberships will take effect when you log in and don't normally change otherwise).
You can either log in and out to let the group change take effect, or changing your "active" group with the newgrp command will also do this for you.