FreeBSD chroot sftp и chroot ssh

############## : BEGIN
#pw usermod sftponly -d /usr/local/www/
#chown root:wheel /usr/local/www/
#AllowGroups wheel sftp
#AllowUsers user1 user2 user3@192.168.1.1 user3@192.168.2.*

Match User web
   ChrootDirectory /home/%u
   X11Forwarding no
   AllowTcpForwarding no

Match Group sftp
   ChrootDirectory %h
   X11Forwarding no
   AllowTcpForwarding no
   ForceCommand internal-sftp
############## : END

FreeBSD# adduser
Username: sftp
Full name:     
Uid (Leave empty for default): 
Login group [sftp]: 
Login group is sftp. Invite sftp into other groups? []: 
Login class [default]: 
Shell (sh csh tcsh nologin) [sh]: nologin
Home directory [/home/sftp]: /usr/local/www
Home directory permissions (Leave empty for default): 
Use password-based authentication? [yes]: 
Use an empty password? (yes/no) [no]: 
Use a random password? (yes/no) [no]: 
Enter password: 
Enter password again: 
Lock out the account after creation? [no]: 
Username   : sftp
Password   : *****
Full Name  : 
Uid        : 1002
Class      : 
Groups     : sftp 
Home       : /usr/local/www
Home Mode  : 
Shell      : /usr/sbin/nologin
Locked     : no
OK? (yes/no): y
adduser: INFO: Successfully added (sftp) to the user database.
Add another user? (yes/no): y
Username: web
Full name: 
Uid [1003]: 
Login group [web]: 
Login group is web. Invite webb into other groups? []: 
Login class [default]: 
Shell (sh csh tcsh nologin) [sh]: csh
Home directory [/usr/local/web]: /home/web
Home directory permissions (Leave empty for default): 
Use password-based authentication? [yes]: 
Use an empty password? (yes/no) [no]: 
Use a random password? (yes/no) [no]: 
Enter password: 
Enter password again: 
Lock out the account after creation? [no]: 
Username   : web
Password   : *****
Full Name  : 
Uid        : 1003
Class      : 
Groups     : web 
Home       : /home/web
Home Mode  : 
Shell      : /bin/csh
Locked     : no
OK? (yes/no): y
adduser: INFO: Successfully added (web) to the user database.
Add another user? (yes/no): n
Goodbye!

#!/bin/sh

# Проверка задано ли имя пользователя
if [ -z "$1" ] ; then
 echo "  Usage: $0 [ username ]"
 exit 1
fi

USER=$1
GID=$(id -g $USER)
HOMEDIR=/home/$USER

# Задаем список каталогов в chroot окружении.
SKEL="/bin
    /sbin
    /etc
    /home/$USER
    /lib
    /libexec
    /tmp
    /usr/bin
    /usr/share
    /usr/local/bin
    /usr/local/etc
    /usr/local/share
    /usr/local/libexec"

# Создаем структуру каталогов внутри `chroot` окружения
for i in $SKEL; do
    [ ! -d $HOMEDIR$i ] && mkdir -pv $HOMEDIR$i
done

# Определяем какие библиотеки необходимо скопировать
for item in sh csh zcat cat tbl groff chmod cp echo \
    ln ls date expr mkdir mv pwd locale \
    rm rmdir awk bzip2 diff du \
    ee fetch find grep gunzip gzip \
    more less sed sort tail head \
    tar touch vi ee mc mcedit \
    mysql mysqldump clear tput reset man zcat troff grotty; do
    p=$(whereis -q $item | awk '{print $1}')
    if [ -n "$p" ]; then
        # Копируем бинарники внутрь chroot окружения
        cp -vf $p $HOMEDIR$p
        ldd $p | awk '{print $3}' | grep '.' >>/tmp/chroot_liblist
        #ldd $CMD_LIST|grep -v ':$'|grep -v "not a dynamic executable"|cut -f 3 -d " "|sort|uniq|sed 1d
    else
        echo "$item is NOT found, skip!"
    fi
done

# Копируем библиотеки
for item in $(cat /tmp/chroot_liblist | sort | uniq); do
    cp -vf $item $HOMEDIR/lib/
done
# Подчищаем за собой
[ -f /tmp/chroot_liblist ] && rm -vf /tmp/chroot_liblist

# Копируем оставшиеся необходимые файлы и библиотеки
for i in /etc/termcap \
    /etc/resolv.conf \
    /etc/nsswitch.conf \
    /libexec/ld-elf.so.1 \
    /libexec/ld-elf32.so.1; do
    cp -vf $i $HOMEDIR$i
done

# если копировали mc, то копируем все необходимые для mc файлы.
for i in /usr/local/share/mc \
    /usr/local/libexec/mc \
    /usr/local/etc/mc \
    /usr/local/man \
    /usr/share/man \
    /usr/share/groff_font \
    /usr/share/tmac; do
    cp -vfR $i $HOMEDIR$i
done

# Если копировали mysql клиента, то настроим дефолтные опции.
cat >$HOMEDIR/usr/local/etc/my.cnf<<-_EOF
    [client]
    port=3306
    host=192.168.120.2
_EOF

# Генерируем /etc/motd для chroot окружения
echo 'Welcome to chroot environment' > $HOMEDIR/etc/motd

# Генерируем csh.cshrc для chroot окружения
echo 'setenv TERMCAP /etc/termcap' > $HOMEDIR/etc/csh.cshrc
cp -fv /.cshrc $HOMEDIR/home/$USER/

#т.к. man требует зачем-то наличие /sbin/sysctl, то создаем заглушку - пустой файл с правами запуска.
[ ! -d $HOMEDIR/sbin/ ] && mkdir -pv $HOMEDIR/sbin
[ ! -x $HOMEDIR/sbin/sysctl ] && chmod -v +x $HOMEDIR/sbin/sysctl

# Генерируем /etc/group для chroot окружения
grep $GID /etc/group > $HOMEDIR/etc/group

# Переносим запись о пользователе
grep "^$USER:" /etc/master.passwd > $HOMEDIR/etc/master.passwd
pwd_mkdb -d $HOMEDIR/etc $HOMEDIR/etc/master.passwd

# Выставляем права
chown root:wheel $HOMEDIR
chmod 755 $HOMEDIR
chmod 777 $HOMEDIR/tmp

for i in $SKEL; do
    chown -vR $USER:$GID $HOMEDIR$i
done

sh add_ssh_chrootuser.sh web

FreeBSD# service sshd restart
Stopping sshd.
Starting sshd.