Как настроить интерактивный сеанс в ChrootDirectory (не для sFTP)

Question

цель состоит в том, чтобы создать что-то наподобие docker, но использовать традиционный способ, chroot.

Я начал с создания раздела в ext4 и монтирования его в /srv/container/test и установки стандартной системы linux с помощью pacstrap /srv/container/test base. Я также подготовил виртуальные файловые системы ядра:

export ROOTDIR=/srv/container/test
mount -v --bind /dev $ROOTDIR/dev
mount -vt tmpfs tmpfs $ROOTDIR/run
mount -vt sysfs sysfs $ROOTDIR/sys
mount -vt proc proc $ROOTDIR/proc
mount -vt devpts devpts -o gid=5,mode=0620 $ROOTDIR/dev/pts

Я проверил это, просто выполнив chroot в локальной системе, и это работает.

Однако, когда я попытался настроить ssh сервер для использования его как ChrootDirectory, он выводит ошибку закрытия канала подключения, я проверил журнал ssh: journalctl -u sshd, но не вижу фактической ошибки в журнале:

...
Feb 25 03:12:34 zero sshd-session[33517]: Accepted password for root from 10.0.2.15 port 51616 ssh2
Feb 25 03:12:34 zero sshd-session[33517]: debug1: monitor_child_preauth: user root authenticated by privileged process
Feb 25 03:12:34 zero sshd-session[33517]: debug3: mm_get_keystate: Waiting for new keys
Feb 25 03:12:34 zero sshd-session[33517]: debug3: mm_request_receive_expect: entering, type 26
Feb 25 03:12:34 zero sshd-session[33517]: debug3: mm_request_receive: entering
Feb 25 03:12:34 zero sshd-session[33517]: debug3: mm_get_keystate: GOT new keys
Feb 25 03:12:34 zero sshd-session[33517]: debug3: mm_auth_password: user authenticated [preauth]
Feb 25 03:12:34 zero sshd-session[33517]: debug3: user_specific_delay: user specific delay 0.000ms [preauth]
Feb 25 03:12:34 zero sshd-session[33517]: debug3: ensure_minimum_time_since: elapsed 529.640ms, delaying 131.069ms (requested 5.162ms) [preauth]
Feb 25 03:12:34 zero sshd-session[33517]: debug3: mm_do_pam_account entering [preauth]
Feb 25 03:12:34 zero sshd-session[33517]: debug3: mm_request_send: entering, type 102 [preauth]
Feb 25 03:12:34 zero sshd-session[33517]: debug3: mm_request_receive_expect: entering, type 103 [preauth]
Feb 25 03:12:34 zero sshd-session[33517]: debug3: mm_request_receive: entering [preauth]
Feb 25 03:12:34 zero sshd-session[33517]: debug3: mm_do_pam_account returning 1 [preauth]
Feb 25 03:12:34 zero sshd-session[33517]: debug3: send packet: type 52 [preauth]
Feb 25 03:12:34 zero sshd-session[33517]: debug3: mm_request_send: entering, type 26 [preauth]
Feb 25 03:12:34 zero sshd-session[33517]: debug3: mm_send_keystate: Finished sending state [preauth]
Feb 25 03:12:34 zero sshd-session[33517]: debug1: monitor_read_log: child log fd closed
Feb 25 03:12:34 zero sshd-session[33517]: debug3: ssh_sandbox_parent_finish: finished
Feb 25 03:12:34 zero sshd-session[33517]: debug1: PAM: establishing credentials
Feb 25 03:12:34 zero sshd[33514]: debug2: server_accept_loop: child 33517 for connection from 10.0.2.15 to 10.0.2.15 auth done
Feb 25 03:12:34 zero sshd[33514]: debug1: child_close: enter (forcing)
Feb 25 03:12:34 zero sshd-session[33517]: debug3: PAM: opening session
Feb 25 03:12:34 zero sshd-session[33517]: debug2: do_pam_session: auth information in SSH_AUTH_INFO_0
Feb 25 03:12:34 zero sshd-session[33517]: pam_unix(sshd:session): session opened for user root(uid=0) by root(uid=0)

и ничего полезного в клиентском логе:

...
Authenticated to 10.0.2.15 ([10.0.2.15]:22) using "password".
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug3: send packet: type 90
debug1: Requesting [email protected]
debug3: send packet: type 80
debug1: Entering interactive session.
debug1: pledge: filesystem
debug3: client_repledge: enter
Read from remote host 10.0.2.15: Connection reset by peer
Connection to 10.0.2.15 closed.
debug3: send packet: type 1
client_loop: send disconnect: Broken pipe

что вызывает ошибку “Broken pipe”? это не ясно для меня.

мой файл sshd_config выглядит так:

# Include drop-in configurations
Include /etc/ssh/sshd_config.d/*.conf

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
ListenAddress 10.0.2.15
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO
LogLevel DEBUG3

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
PermitRootLogin yes
#PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile  .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
#KbdInteractiveAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the KbdInteractiveAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via KbdInteractiveAuthentication may bypass
# the setting of "PermitRootLogin prohibit-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and KbdInteractiveAuthentication to 'no'.
#UsePAM no

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem   sftp    /usr/lib/ssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#   X11Forwarding no
#   AllowTcpForwarding no
#   PermitTTY no
#   ForceCommand cvs server

# Match User demo
Match User root
        ChrootDirectory /srv/container/test
    PasswordAuthentication yes

по моему пониманию, выполняется следующий шаг: клиент аутентифицируется на ssh-сервере -> ssh-сервер выполняет chroot -> запускает /srv/container/test/usr/bin/bash, а домашний каталог устанавливается в /srv/container/test/root/

является ли это действительным?

Как настроить интерактивный сеанс в ChrootDirectory (не для sFTP)

Вопрос или проблема

Ответ или решение

Теория

Пример

Применение