MAN page from RedHat EL 7 rssh-2.3.3-2.el7.rf.x86_64.rpm
Section: Derek D. Martin (5)
Updated: 7 Jul 2003Index
/etc/rssh.conf - configuration file for rssh
is the configuration file for rssh
. It allows the system administratorto control the behavior of the shell. Configuration keywords are either usedby themselves on a line, or followed by an equal sign ('=') and aconfiguration value. Comments start with a hash ('#') and can occur anywhereon the line. Configuration options are case insensitive. Spaces at thebeginning or end of line, or between the equal sign and the configurationkeywords or values are ignored. If the value of a configuration optioncontains spaces, it (or at least the space) must be enclosed in either singleor double quotes.A default configuration file is provided with the source distribution ofrssh
. If the configuration file is missing or contains errors, sshwill lock out all users. If a config file is present, the default is to lockout users if no services have been explicitly allowed.New in v2.1 is the ability to configure options on a per-user basis, using theuser keyword. More details are below.
CONFIGURATION KEYWORDS allowscp
- Tells the shell that scp is allowed.
- Tells the shell that sftp is allowed.
- Tells the shell that cvs is allowed.
- Tells the shell that rdist is allowed.
- Tells the shell that rsync is allowed.
- Sets the umask value for file creations in the scp/sftp session. This isnormally set at login time by the user's shell. In order not to use thesystem default, rssh must set the umask.
- Allows the system administrator to control what syslog facilityrsshlogs to. The facilities are the same as those used by syslogd.conf(5),or the C macros for the facilities can be used instead. For example:logfacility=user
logfacility=LOG_USERare equivalent, and tellrsshto use the user facility for logging to syslog.
- Causes rssh (actually a helper program) to call the chroot() system call, changing the root of the file system to whatever directory isspecified. Note that the value on the right hand side of the equal sign isthe name of a directory, not a command. For example:chrootpath=/usr/chrootwill change the root of the virtual file system to /usr/chroot, preventing theuser from being able to access anything below /usr/chroot in the file system,and making /usr/chroot appear to be the root directory. Care must be taken toset up a proper chroot jail; see the file CHROOT in the rssh sourcedistribution for hints about how to do this. See also the chroot(2) manpage.If the user's home directory (as specified in /etc/passwd) is underneaththe path specified by this keyword, then the user will be chdir'd into theirhome directory. If it is not, then they will be chdir'd to the root of thechroot jail.In other words, if the jail is /chroot, and your user's home directoryis /chroot/home/user, then once rssh_chroot_helper changes theroot of the system, it will cd into /home/user inside the jail.However, if your user's home directory is given as /home/user in/etc/passwd, then even if that directory exists in the jail, the chroothelper will not try to cd there. The user's normal home directory must liveinside the jail for this to work.
- The user keyword allows for the configuration of options on a per-user basis.THIS KEYWORD OVERRIDES ALL OTHER KEYWORDS FOR THE SPECIFIED USER.That is, if you use a user keyword for user foo, then foo will use only thesettings in that user line, and not any of the settings set with the keywordsabove. The user keyword's argument consists of a group of fields separated bya colon (':'), as shown below. The fields are, in order:username
- The username of the user for whom the entry provides options
- The umask for this user, in octal, just as it would be specified to the shell
- Five binary digits, which indicate whether the user is allowed to use rsync,rdist, cvs, sftp, and scp, in that order. One means the command is allowed,zero means it is not.
For example, you might have something like this:user = luser:022:00001:This does the following: for the user with the username "luser", set the umaskto 022, disallow sftp, and allow scp. Because there is no chroot pathspecified, the user will not be chrooted, regardless of default options set with the keywords above.If you wanted this user to be chrooted, you would need to specify the chrootpath explicitly, even if it should be the same as that set using thechrootpath keyword. Remember that if there are spaces in the path, you needto quote it, something like this:user = "luser:022:00001:/usr/local/chroot dir"See the default rssh.conf file for more examples.
- The directory to which this user should be chrooted (this is not acommand, it is a directory name). See chroot_path above for completedetails.
- CONFIGURATION KEYWORDS
- SEE ALSO
This document was created byman2html,using the manual pages.