Re: [Jailkit-users] closed connection for sftp in a chrooted jail

[Olivier Sessink]

Russ Lavoie wrote:
> Yes, jk_socketd is running.
> 
> address@hidden openssh]# ps ax | grep jk_socketd
> 13178 ?        Ss     0:00 /usr/sbin/jk_socketd
> 
> I am running winscp as SFTP
> 
> How would I go about getting logs from the Jail?  When I try to tail
> /var/ftp/dev/log I get an access denied message as root.  I assume this
> is a redirect to some other log file (may not exist on my server).  But
> I am not a whiz at this.

it is a socket, the logs are redirected by jk_socketd to the real
/dev/log, which is a socket from syslogd

you can also configure syslogd to directly open this socket, by
appending "-a /var/ftp/dev/log" to its commandline.

so your logs should be in /var/log/* where all your other logs are.

if you have only logging outside the jail you see:
Nov 20 20:02:43 alpha jk_chrootsh[5977]: now entering jail /home/jail
for user test (1001)

if you have logging inside the jail you see:
Nov 20 20:04:07 alpha jk_chrootsh[27056]: now entering jail /home/jail
for user test (1001)
Nov 20 19:04:07 alpha jk_lsh[27056]: jk_lsh, started
Nov 20 19:04:07 alpha jk_lsh[27056]: executing command
'/usr/libexec/sftp-server' for user test (1001)

so it gives much more info

regards,
        Olivier