scopnly - scponlyc fails to chroot and the make chroot script fails

Bug #611400 reported by Rafal-maj-it
16
This bug affects 3 people
Affects Status Importance Assigned to Milestone
scponly (Ubuntu)
Invalid
Undecided
Unassigned

Bug Description

scponlyc does not work (can not build chroot for it)
Don't know workarounds for scponlyc, other then using INSECURE scponly mode - therefore marking this as security bug.

scponly 4.8-4 on Ubuntu Lucid 64bit

Trying to follow say:
http://ubuntuforums.org/showthread.php?t=451510

scponlyc (the CHROOTED version of scponly) does not work on new user, its needed to build dir for chroot.

Using the described script does not work:

cd /usr/share/doc/scponly/setup_chroot
sudo gunzip setup_chroot.sh.gz

that script complains that scponlyc is not setup (while it IS set up correctly with that YES option
after skipping that warning, all is created, but it does not work
it can not find the lib

running: /usr/lib/sftp-server
failed: /usr/lib/sftp-server with error No such file or directory(2)

copying that /usr/lib/sftp-server into chroot is not sufficient to fix this.
So I assume the make-chroot-script is not valid there.
Then it should be removed or upgraded.

Don't know workarounds for scponlyc, other then using INSECURE scponly mod - therefore marking this as security bug.
Or for using sftp from ssh (will that work?) and not using scponly at all (but then, is it as good solution?)

Tags: lucid
affects: ubuntu → scponly (Ubuntu)
visibility: private → public
description: updated
Philip Muškovac (yofel)
tags: added: lucid
Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privilege boundaries nor directly cause loss of data/privacy. Please feel free to report any other bugs you may find.

security vulnerability: yes → no
Revision history for this message
Phillip Susi (psusi) wrote :

This package has been removed from Ubuntu. Closing all related bugs.

Changed in scponly (Ubuntu):
status: New → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.