Debian Buster + Jailkit concern

Discussion in 'Installation/Configuration' started by burlyhousetech, Sep 15, 2020.

  1. Fresh install of ISPConfig v3.1.15p3 running on Debian Buster with Jailkit v2.21 using Perfect Server guide.

    After creating an SFTP (shell) user with Jailkit the user is unable to login. There appear to be multiple issues together conspiring in producing this symptom:
    1. error in /etc/jailkit/jk_init.ini
    2. missing /bin/bash (+ others)
    3. concern between Jailkit v2.2.1 on Debian 10 (or Python?)
    ~~~

    Looking at /var/log/auth.log yields this hint:
    Code:
    jk_chrootsh[10490]: ERROR: failed to execute shell /bin/bash for user ****** (####), check the permissions and libraries of /var/www/clients/client1/web###//bin/bash
    
    OK, so peeking inside the web user's I note that there are a lot of missing binaries:
    Code:
    $ ls bin
    basename  dircolors  dirname  groups  id  lesspipe  mysql  mysqldump  nano  patch  pico  rm  tar  unzip  zip
    
    Digging further, I found this entry in /var/log/ispconfig/cron.log:
    Code:
    Tue 15 Sep 2020 10:29:01 AM CDT Traceback (most recent call last):
    Tue 15 Sep 2020 10:29:01 AM CDT File "/usr/sbin/jk_init", line 261, in <module>
    Tue 15 Sep 2020 10:29:01 AM CDT main()
    Tue 15 Sep 2020 10:29:01 AM CDT File "/usr/sbin/jk_init", line 258, in main
    Tue 15 Sep 2020 10:29:01 AM CDT activateConfig(config, jail, args)
    Tue 15 Sep 2020 10:29:01 AM CDT File "/usr/sbin/jk_init", line 164, in activateConfig
    Tue 15 Sep 2020 10:29:01 AM CDT cfg.read([config['file']])
    Tue 15 Sep 2020 10:29:01 AM CDT File "/usr/lib/python3.7/configparser.py", line 696, in read
    Tue 15 Sep 2020 10:29:01 AM CDT self._read(fp, filename)
    Tue 15 Sep 2020 10:29:01 AM CDT File "/usr/lib/python3.7/configparser.py", line 1091, in _read
    Tue 15 Sep 2020 10:29:01 AM CDT fpname, lineno)
    Tue 15 Sep 2020 10:29:01 AM CDT configparser.DuplicateOptionError: While reading from '/etc/jailkit/jk_init.ini' [line 115]: option 'includesections' in section 'openvpn' already exists
    Tue 15 Sep 2020 10:29:02 AM CDT invalid shell, /var/www/clients/client1/web597/bin/bash does not exist
    Tue 15 Sep 2020 10:29:02 AM CDT finished.
    
    When I try to run jk_list:
    Code:
    # jk_list
    bash: jk_list: command not found
    # /usr/sbin/jk_list
    Traceback (most recent call last):
      File "/usr/sbin/jk_list", line 159, in <module>
        main()
      File "/usr/sbin/jk_list", line 156, in main
        printResults(results,wide)
      File "/usr/sbin/jk_list", line 92, in printResults
        results.sort()
    TypeError: '<' not supported between instances of 'ListResult' and 'ListResult'
    
    ~~~

    I've noted there are others who are recently describing similar issues, but this one in particular looks related:
    https://www.howtoforge.com/community/threads/possible-ubuntu-20-04-jailkit-issue.85071/#post-408047
     
  2. Fix for the reported Jailkit error is straight forward:
    Code:
    configparser.DuplicateOptionError: While reading from '/etc/jailkit/jk_init.ini' [line 115]: option 'includesections' in section 'openvpn' already exists
    
    Looking in /etc/jailkit/jk_init.ini simply delete the duplicate `includesections` found in `openvpn`.

    After this fix is applied I'm able to mostly create a jailkit manually for that user's directory:
    Code:
    $ sudo jk_init -j /var/www/clients/client1/web597/ basicshell editors extendedshell netutils ssh sftp scp groups jk_lsh
    usr/bin/var/www/clients/client1/web597/bin
    
    Code:
    Traceback (most recent call last):
      File "/usr/sbin/jk_init", line 261, in <module>
        main()
      File "/usr/sbin/jk_init", line 258, in main
        activateConfig(config, jail, args)
      File "/usr/sbin/jk_init", line 173, in activateConfig
        ji.handle_cfg_section(config,jail,cfg,section)
      File "/usr/sbin/jk_init", line 110, in handle_cfg_section
        self.handle_cfg_section(config,chroot,cfg,tmp)
      File "/usr/sbin/jk_init", line 157, in handle_cfg_section
        jk_lib.create_parent_path(chroot,os.path.dirname(tmp), config['verbose'], copy_permissions=0, allow_suid=0, copy_ownership=0)
      File "/usr/share/jailkit/jk_lib.py", line 485, in create_parent_path
        os.mkdir(jailpath, dir_mode)
    PermissionError: [Errno 1] Operation not permitted: '/var/www/clients/client1/web597/dev'
    
    Is there some method of triggering a rebuild of jailkit for a given vhost, or will I have to delete the ISPConfig Site and start anew?
     
  3. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

  4. Jesse Norell

    Jesse Norell Well-Known Member Staff Member Howtoforge Staff

    Remove the /etc/jailkit/ directory within the jail, then update something (eg. password) in your shell user.
     
  5. Jesse Norell

    Jesse Norell Well-Known Member Staff Member Howtoforge Staff

    Th0m likes this.
  6. Jesse Norell

    Jesse Norell Well-Known Member Staff Member Howtoforge Staff

    Perhaps the issue is due to python 3 not parsing the jail with the duplicate section the same as an older version did (I really don't know), but the first link you post explains the simple workaround is to remove the extra includesections line.

    I use 2.21 on Buster without issue. For fun I also tested adding that extraneous includesections line back in to my jk_init.ini on a buster system with 2.20, and it produces the exact same failure, so a clear 'no' on that idea as a workaround.
     
  7. Richard Foley

    Richard Foley Member

    I'm seeing what I think is this same error:
    Code:
    # jk_cp -j /var/www/clients/client$n/web$n/ /usr/bin/git
    Traceback (most recent call last):
     File "/usr/sbin/jk_cp", line 121, in <module>
       main()
     File "/usr/sbin/jk_cp", line 118, in main
       startcopy(config, jail, args)
     File "/usr/sbin/jk_cp", line 47, in startcopy
       allow_suid=config['retainsetuid'], retain_owner=config['retainowner'])
     File "/usr/share/jailkit/jk_lib.py", line 642, in copy_binaries_and_libs
       create_parent_path(chroot,os.path.dirname(file), be_verbose, copy_permissions=1, allow_suid=allow_suid, copy_ownership=retain_owner)
     File "/usr/share/jailkit/jk_lib.py", line 464, in create_parent_path
       os.mkdir(jailpath, 0755)
    OSError: [Errno 1] Operation not permitted: '/var/www/clients/client$n/web$n/usr'
    Has a solution/fix been found?
     
  8. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Jailkit handling is much rewritten in ISPConfig 3.2. So which version are you running?
     
    Richard Foley likes this.
  9. Richard Foley

    Richard Foley Member

    <slaps head> sorry, forgot to include this info:
    Code:
    OS: Linux 4.19.0-8-686-pae #1 SMP Debian 4.19.98-1+deb10u1 (2020-04-27) i686
    ISPConfig 3.2.1
    jk_cp doesn't appear to have any version information, but the md5 may help:
    Code:
    md5sum /usr/sbin/jk_cp
    ef58f649ed1643bee8b53448219fa1d3  /usr/sbin/jk_cp
     
  10. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Looks like you have Debian Buster, you can verify with
    Code:
    lsb_release -a
    cat /etc/debian_version
    Check what version jailkit is now:
    Code:
    apt policy jailkit
    For Buster jailkit is available from Debian Backports, https://packages.debian.org/buster-backports/jailkit
    Read how to add backports and install jailkit from there: https://backports.debian.org/
    With that jailkit it may start working better.
     
  11. Richard Foley

    Richard Foley Member

    Buster, yep, and the other info is here:
    Code:
    # lsb_release -a
    No LSB modules are available.
    Distributor ID: Debian
    Description:    Debian GNU/Linux 10 (buster)
    Release:        10
    Codename:       buster
    # cat /etc/debian_version
    10.6
    # apt policy jailkit
    jailkit:
     Installed: 2.19-1
     Candidate: 2.19-1
     Version table:
    *** 2.19-1 100
           100 /var/lib/dpkg/status
    
     
  12. Richard Foley

    Richard Foley Member

    Installed from buster backports:
    Code:
    # apt policy jailkit
    jailkit:
      Installed: 2.21-2~bpo10+1
      Candidate: 2.21-2~bpo10+1
      Version table:
     *** 2.21-2~bpo10+1 100
            100 http://deb.debian.org/debian buster-backports/main i386 Packages
            100 /var/lib/dpkg/status
    
    Unfortunately no difference: :(
    Code:
    # jk_cp -j /var/www/clients/clientn/webn/ /usr/bin/git
    Traceback (most recent call last):
      File "/usr/sbin/jk_cp", line 123, in <module>
        main()
      File "/usr/sbin/jk_cp", line 120, in main
        startcopy(config, jail, args)
      File "/usr/sbin/jk_cp", line 49, in startcopy
        allow_suid=config['retainsetuid'], retain_owner=config['retainowner'])
      File "/usr/share/jailkit/jk_lib.py", line 668, in copy_binaries_and_libs
        create_parent_path(chroot,os.path.dirname(file), be_verbose, copy_permissions=1, allow_suid=allow_suid, copy_ownership=retain_owner)
      File "/usr/share/jailkit/jk_lib.py", line 485, in create_parent_path
        os.mkdir(jailpath, dir_mode)
    PermissionError: [Errno 1] Operation not permitted: '/var/www/clients/clientn/webn/usr'
    #
    
     
    Last edited: Nov 30, 2020
  13. Jesse Norell

    Jesse Norell Well-Known Member Staff Member Howtoforge Staff

    The base web# directory of a site is set immutable, you sometimes need to change that if you run jk_cp manually.

    Note in 3.2 you can set jailkit options for each individual site, so just copy the jailkit sections from your server config to the website options, add 'git' to the end, and it should just work.
     
  14. Richard Foley

    Richard Foley Member

    I appreciate the feedback, Jesse and Taleman both.
    I'm really trying to avoid having to change the configuration for each individual site manually. That's an admin's nightmare, surely. There must be some way for this to work nearly "out of the box". I'm just trying to apply a single new application (git) to all existing sites. This cannot be so complicated, surely?
    Code:
    . ~/bin/jk_updater_ispc -v
    The above code is what I would ideally use. However, this runs and does nothing as, if I recall correctly, this command is only useful for NEW sites. What I need is to update existing sites, hence my use of the `jk_cp` command earlier.
     
  15. till

    till Super Moderator Staff Member ISPConfig Developer

    Try this:

    Code:
    chattr -i /var/www/clients/client$n/web$n 
    jk_cp -j /var/www/clients/client$n/web$n/ /usr/bin/git
    chattr +i /var/www/clients/client$n/web$n
     
    Richard Foley likes this.
  16. Richard Foley

    Richard Foley Member

    That did it, Till, many thanks! :)
     
  17. Jesse Norell

    Jesse Norell Well-Known Member Staff Member Howtoforge Staff

    Just add 'git' to the jailkit sections in server config, and it will add it to all jails.
     
    Richard Foley likes this.
  18. Jesse Norell

    Jesse Norell Well-Known Member Staff Member Howtoforge Staff

    Also, don't use jk_updater_ispc on a 3.2 system, it has a better updater built in.
     
    Richard Foley likes this.
  19. Richard Foley

    Richard Foley Member

    The specific issue is resolved via Till's comment above (using chattr). Still, I'd like to get the general procedure correct for future use. Do you mean that just adding the app. to the server config is sufficient to run the built-in jailkit updater against all existing sites?
    • System -> Server Config -> Host -> Jailkit
    And this should work, as I'd have expected, regardless whether existing old site or future new site?

     
    Last edited: Dec 2, 2020

Share This Page