Skip to main content

Stale VirtFS Files?

vatra
  • Edited
I have discovered that VirtFS copies of system files are not up to date, which causes errors. Before I explain what I'm doing outside of VirtFS, just know that I'm not asking for help with that part.
 
I'm matching some users in the sshd_config file to apply certain directives just to them:
Match Group group1
I've created a Linux group and added a user to it:
groupadd group1
usermod -aG  group1  user1

But there is a problem. When I try to log in via a terminal app or go to WHM Terminal as a user who is a member of this group, although everything works as it should, I get the following error id: cannot find name for group ID xxxx.
 
This is because of the VirtFS JailedShell. When I create a group, the OS writes it into the /etc/group file. But since VirtFS virtualization uses its own copies of system files, the group file, located in /home/virtfs/[user]/etc/group doesn't get updated.
 
How to ensure that VirtFS has the latest versions of files?

Comments

17 comments

Date Votes
  • cPRex Jurassic Moderator

    Hey there!  I 100% believe I replied to this last night, but there's nothing showing up here.

    I did reach out to the developers about this and they confirmed that VirtFS appears out of date because this work is being performed manually outside of the cPanel system.  The only way to keep things like this up to date would be to remount VirtFS manually.  The safest way to do this is usually to reboot the server, but I know that isn't ideal.

    1
  • vatra

    Hey! I will try it, but before that, I have a simpler hack:

    Since this concerns a single Linux group, can I manually add its line from /etc/group to the users /home/virtfs/[user]/etc/group files? Would that be OK?

    0
  • cPRex Jurassic Moderator

    Maybe?  I don't see why that would be bad, but you're drifting into uncharted territory a bit.

    1
  • vatra

    I did a graceful reboot, and it changed nothing.

    0
  • vatra

    Adding a group line to a group file removed the error. But as you said, this is not the best way to do it.

    0
  • vatra

    Rebooting did not remount VirtFS manually. Is there any other way to do it?

    0
  • cPRex Jurassic Moderator

    That surprises me a bit, as it should build the VirtFS system as part of the reboot.  It's also completely possible that this just doesn't integrate with the way we have VirtFS configured.  

    1
  • vatra

    So what are my options? I don't get it. Why would the group file not be updated from time to time in VirtFS? It's a pretty important file.

    0
  • cPRex Jurassic Moderator

    Let's start fresh with some questions from my end :)

    First question: Are these users in question cPanel account users?  As in, the main cPanel username of an account on your server?

    Second question: What exactly is the end goal here?  I'm being told there is no reliable way to force that VirtFS update, but I'd like to know what you're trying to achieve before I recommend anything else.

    1
  • vatra
    • Edited

    Yes, they are. :)

    I need to add some users (cPanel accounts) to a group so I can apply custom SSH directives to them.

    0
  • cPRex Jurassic Moderator

    Perfect - I just wanted to confirm that.

    What specific customizations were you looking to apply?

    1
  • vatra

    I'm forcing SFTP and disabling shell access to all, and allowing shell access just for that group.

    Match Group mygroup
        # Shell enabling code
    Match Group *,!mygroup
        ForceCommand internal-sftp
    0
  • vatra
    • Edited

    Previously, I've achieved this by matching users, but it's much easier to add a user to a group than to constantly add users to the SSH config.

    Match User user1,user2,user3
        # Shell enabling code
    Match Group *,!user1,!user2,!user3
        ForceCommand internal-sftp
    0
  • cPRex Jurassic Moderator

    Thanks for that information.  I am not seeing how this is related to VirtFS.

    What errors do you see in /var/log/secure when one of those users in the applied group tries to log in?  Does that tell us anything interesting?

    Is it possible the AllowGroups option would be an easier way to do this?  https://www.man7.org/linux/man-pages/man5/sshd_config.5.html

    1
  • vatra

    It doesn't relate, but VirtFS is causing an error. When I create a Linux group, the group is created in the /etc/group file: mygroup:x:5463:user1,user2. VirtFS is not mirroring the changes from this file to its copy of it.

    So when a user who is in this group tries to access the shell via terminal, this error gets printed: id: cannot find name for group ID 5463.

    So, it's the VirtFS copy that doesn't have this info, not anything related to SSH.

    0
  • cPRex Jurassic Moderator

    I think the core of the issue here is a misunderstanding of what VirtFS does.  VirtFS doesn't replicate files on the system to a copy - VirtFS uses hard links to existing files so users can access them over their jailed SSH connection.  This is why we warn users that if you delete something in VirtFS it deletes the "real" file as well.

    The only thing that triggers updates to it is the jailshell system - it doesn't know about /etc/group, or any other work that is done by the root user.

    I don't believe there is a way to get things working how you expect on a cPanel server with the way jailshell is implemented.

    1
  • vatra

    I'll probably revert to user instead of group matching. It's more "paperwork", but at least I'm not meddling with VirtFS. I still don't know what triggers VirtFS to update the contents of this file.

    Thank you, nevertheless.

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post