scponly restricted shell
 
 

Modifications to this Solaris package away from the standard source:.

  • This package automatically adds scponly and scponlyc in /etc/shells. Removing this package will remove these shells.
  • As as quick and easy way of creating jails, I added
    • setup_scponly - Installs scponly, allowing the user to traverse directories
    • setup_scponlyc - Installs scponly in a jailed environment
    These are a modification of the setup_chroot.sh script with modifications.
  • The default binaries required and upon which the libraries used for the jail
    rely, are listed in /usr/local/etc/scponly/scponly.binaries. This allows a
    Solaris packing approach without relying on source code.

  • Additionally, the default username, homedirectory base and writeable directory
    can be defined and will override the script defaults. Defined in:
    /usr/local/etc/scponly/scponly.binaries.

  • Setting the defaultwriteabledir to in the above file to _USERNAME_ will allow for default paths such as:
    /export/home/james/james
    where
    /export/home/james/ is the home directory with
    /export/home/james/james being the writable directory.

I hope this helps all those underpaid and overworked Solaris admins. Enjoy.

This package installs into /usr/local.

Build Info:

Solaris 10 SPARC 11/06
scponly 4.8
gcc3.3.2
libiconv 1.8
make 3.80

None are required for the downloadable package to run.

Configure Options:

./configure --enable-winscp-compat --enable-chrooted-binary

Environment:

PATH=/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/usr/ccs/bin:/usr/ucb
LD_LIBRARY_PATH=/usr/local/lib:/usr/lib:/usr/ccs/lib:/usr/ucblib
EDITOR=vi
export PATH LD_LIBRARY_PATH EDITOR

Note:

If you wish to roll your own package, make sure to include /lib/nss_files.so.1

Links:

Scponly wiki - http://sublimation.org/scponly/wiki/index.php/Main_Page
Scp pages on Sourceforge.net