Allrighty,

Well...I've tried everything I thought could be done...but perhaps you guys have some suggestions.

I do not offer telnet on my RaQs, however, ONE customer REALLY needs it...
RaQ4 is great with FTP... They have a certain root and cannot go up dirs from there (prevents them from looking where they shouldnt...) But telnet does not offer this (by default). How do I do this?


Now...

I've tried this:
------------------------------------------------------------------------
The command you want to use is called "chroot". chroot
starts a shell and makes a subdirectory in the system
appear to be the root directory.

So, if you have a user who you want to limit to
/vhosts/somedomain, you should create little shell script
which you can put in /usr/local/bin that looks like this:

#!/usr/sbin/chroot /vhosts/somedomain /bin/bash

Here I've assumed that you have chroot in /usr/sbin and
the shell the user wants to run is /bin/bash. Then
set that user's shell in /etc/passwd to be your shell
script.

One caveat to using chroot is that it cuts off all access
to directories not under that root (which is what you want)
but that also means that access to programs in /bin and
/usr/bin is no longer available so users will not be able
to run any of these programs. You must make new copies
of all software that user will need under the new root.

This is the traditional way to set up anonymous ftp
access as well. That's why most anon ftp sites have a
/bin directory with basic commands in them. If there
wasn't such a directory, the ftp account running in its
own root wouldn't be able to run "ls" or other such things.
------------------------------------------------------------------------

Well...Great..... But dont work :(

Could anyone perhaps help me? GREATLY APPRECIATED!!

Oh btw, It's a RaQ4

The answer, more or less, is that you can't do that. There isn't really any reason why you should want to either: As long as your file permissions are set properly (and if they're not you'll have bigger problems than telnet access!) chrooting users isn't going to improve security.

The main reason that FTP is so commonly run chrooted is not to protect the server from its users, but rather to protect the server from buggy ftp daemons: A sizeable number of root holes have been found in them over the years and chrooting them is a way to minimize the damage another ftpd hole would cause.

Well thanks for the $0.02 but I REALLY need this :) so if someone knows
PLEASE SHARE! :)

Eagle, there are some things you could do, but I don't see why this customers of yours MUST have telnet access!? Anything he/she wants to do, can be done through FTP or web tools (file manager, phpmyadmin, etc).

To complicated to explain I guess...but if anyone could post the solution instead of "why bother" etc that would be greatly appreciated.

I don't want to offend anyone, but I didn't ask for a "why bother" :unhappy:
Again, not trying to be rude here!
So please :dunce: DO NOT misunderstand me :)
All I'm asking for is an answer :stickout

Thank you

Eagle, I hope you're up for a little reading. This issue was discussed earlier in a 62 post long thread. And Tim Greer was part of it, we know how he loves to write :D, hehe.

Anyways, good luck.

http://www.webhostingtalk.com/showthread.php?threadid=7847

This doesn'lt answer your question (I don't know the answer you seek), though neither is it a why bother. You may wish to consider Open SSH as a replacement for telnet. it is far more secure. http://openssh.org Perhaps the answer you seek can be found on their pages

The only solution that works well is to use a chrooted jail. Try using the jail command - it's probably easier to grasp than the chroot command for a newbie (but it does the same).

Be prepared to use some extra disk space for the required libraries and programs. If you only have that one telnet user, it shouldn't be a problem though.

--
Jens Kristian Søgaard, Mermaid Consulting I/S,
jens@mermaidconsulting.dk,
http://www.mermaidconsulting.com/
http://www.raqsupport.net/

Originally posted by zolbian
Eagle, there are some things you could do, but I don't see why this customers of yours MUST have telnet access!?

If you are looking for an alternative to giving this person telnet access, this question might play the most important part of getting you an answer.