VirtFS Jailed Shell

Overview

cPanel & WHM uses VirtFS to provide a jailed shell environment for users who connect to a server via SSH. The jailed shell acts as a container for the user, and does not allow the user to access other users’ home directories on the server.

• Unlike a normal shell environment, a jailed shell environment increases security for a server’s other users.

• Users in a jailed shell environment can run otherwise-unavailable commands (for example, crontab and passwd).

The virtfs directory

When a user logs in to a jailed shell environment via SSH or SFTP for the first time, the system creates the /home/virtfs/ directory. This directory contains configuration files, utilities, and BIND mounts.

• You cannot prevent the creation of this directory or disable it.

• This directory does not use any disk space. However, because it is a virtual mount point, some commands (for example, du) report that the directory uses disk space.

• BIND mounts create a virtual link between two locations on the file system. For example, if a user views the contents of the /home/virtfs/username/usr/bin/ directory, the user actually sees the contents of the /usr/bin/ directory. For more information about BIND mounts, run the man 8 mount command.

Enable a jailed shell environment

WHM includes two options to activate a jailed shell environment. The option that you use depends on the type of users for whom you wish to enable jailed shells.

To enable a jailed shell environment for all new and modified users, use the Use cPanel® jailshell by default option in WHM’s Tweak Settings interface (WHM >> Home >> Server Configuration >> Tweak Settings).

• This option allows you to force the use of a jailed shell for new accounts and accounts that you subsequently edit in the following interfaces:

  • WHM’s Modify an Account interface (WHM >> Home >> Account Functions >> Modify An Account).

  • WHM’s Upgrade/Downgrade an Account interface (WHM >> Home >> Account Functions >> Upgrade/Downgrade An Account).

• This option does not affect accounts that already exist on the server but that you have not edited in these interfaces.

To enable a jailed shell environment for a specific user, use WHM’s Manage Shell Access interface (WHM >> Home >> Account Functions >> Manage Shell Access).

Exim and VirtFS

When a user’s shell location is /usr/local/cpanel/bin/jailshell (jailed shell is enabled) or /usr/local/cpanel/bin/noshell (all shells are disabled), Exim runs any process from alias or filter files inside VirtFS. This action provides extra security because Exim commands run in a jailed shell and do not affect other users.

CSF or LFD alerts

If you use a utility that monitors system changes (for example, CFS or LFD), you may see an alert that resembles the following example after you upgrade:

1
2
3
4
5

The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way.
This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/bin/crontab: FAILED
/bin/passwd: FAILED

This is a false positive warning. cPanel & WHM uses the /bin/crontab and /bin/passwd symlinks to link to files in the /usr/bin directory. These symlinks allow jailed shell environments to access the crontab and passwd commands.

Disable or remove a jailed shell environment

Disable the jailed shell environment

To disable the jailed shell environment for a specific user, use WHM’s Manage Shell Access interface (Home >> Account Functions >> Manage Shell Access).

To disable the jailed shell environment for all of the users on your server, perform the following steps:

1. Disable the Use cPanel® jailshell by default option in WHM’s Tweak Settings interface (WHM >> Home >> Server Configuration >> Tweak Settings).

2. Select Disabled Shell for all of the server’s accounts in WHM’s Manage Shell Access interface (WHM >> Home >> Account Functions >> Manage Shell Access).

Remove a user’s jailed shell environment

To remove a jailed shell environment, perform the following steps:

1. Disable the jailed shell environment for the user in WHM’s Manage Shell Access interface (WHM >> Home >> Account Functions >> Manage Shell Access).

2. To unmount the VirtFS BIND mounts, run the following command, where username is the desired account username:

   umount /home/virtfs/username/usr/bin

The clear orphaned VirtFS mounts script

You can run the /usr/local/cpanel/scripts/clear_orphaned_virtfs_mounts script to unmount the BIND mounts for users who no longer exist or who no longer use a jailed shell environment. This script removes the /home/virtfs/username/ directory and its contents.

To force the removal of all VirtFS mount points, run the following command, where username is an account’s username:

/usr/local/cpanel/scripts/clear_orphaned_virtfs_mounts --clearall

To check your system for VirtFS mount points, run the following command, where username is the desired account username:

grep -i username /proc/mounts