Chroot-ed ssh shell in ramdisk on OpenBSD 6.8
     =============================================

  Last edited: $Date: 2020/11/16 19:04:47 $

         Memory File System (a.k.a. "ramdisk")
         -------------------------------------

  OpenBSD  provides  the  wonderful  option to mount a
  memory file system, called "mfs file  system",  with
  the -P switch.

  ### Prototype

  Think  of  this -P switch as "prototype". The option
  -P has to be  followed  by  either  a  directorypath
  ("file") or a block device. When -P is followed by a
  directorypath, the mfs file system will  be  created
  with the contents of that path.

  If  followed  by a block device, the mfs file system
  will be created with the contents of  the  FFS  file
  system contained on the device.

  See  the  example below how to add a mfs file system
  to your `/etc/fstab` file.

  The contents are  ***copied***  into  the  mfs  file
  system  at  the time of creation. So, any changes of
  the prototype directory will only  be  reflected  in
  the  mfs  file system after it has been umounted and
  mounted again.

  See man mount_mfs.

  When the chrooted environment is  small  enough,  it
  can  easily  run  in  ram. So we can create a script
  that populates a directory, and  mount  a  mfs  file
  system filled with the contents of that directory.

                      Adding users
                      ------------

  We  start  with  adding  a  group and some users. By
  making the users member of the group,  we  can  tell
  sshd  that  they  belong to the chroot-users, and we
  can build a script based  on  the  fact  that  these
  users are member of the group.

  We use the group "chroot" for this.

    groupadd chroot

  The  users  must be member of this group and no home
  directory in /etc/passwd.

    useradd -g chroot <username>

  Replace <username> with the username of the user.

            Building the chroot environment
            -------------------------------

  First, think about what utilities are necessary  for
  the user. The less the better, in this case.

  We need some basic infrastructure (some directories,
  some  device-files  in  /dev,  /etc/resolv.conf,  et
  cetera)  and  some  utilities  (programs to run). To
  make this easy adaptable it is best to do this  with
  a script.

  In  the  example  build  script  [^1] there are some
  utilities from /bin (like "date") and from  /usr/bin
  ("ssh") that will be put into the chroot.  These are
  just examples, use what you need.

  Every utility takes up space, and perhaps  also  one
  or more extra library files.

                         /proto
                         ------

  The  script  builds  the  chroot  environment in the
  directory `/proto/chroot`.

  I use several mfs file system mounts, and  for  each
  I have a directory in /proto to populate them with.

                    Home directories
                    ----------------

  The  script doesn't delete user home directories, so
  it can be run several times, rebuilding  the  chroot
  environment, without impact for the users.

                  authorized_keys file
                  --------------------

  The  script  finds  the users that are member of the
  group
   'chroot' and creates  a  home-directory  for  these
  users.   The script touches the authorized_keys file
  for each user in it's $HOME/.ssh directory, but  the
  actual public key of the user have to be copied into
  this file. This can be done  after  the  script  has
  run.

              Mounting the mfs file system
              ----------------------------

  When the /proto/chroot directory is complete, we can
  mount the mfs file system.

  Add the mfs file system to your /etc/fstab;

    swap /chroot mfs ro,nosuid,-P=/proto/chroot,-s=48000 0 0

  In this example the mfs filesytem  will  be  mounted
  read  only.  Depending on your needs, you could also
  mount  it  read-write,  sshd  will  check  that  the
  directory  tree is owned by root and can not be over
  written by other users.

  The -s option sets the size of the  mfs  filesystem.
  This  is  the  maximum size, stating to how much you
  can fill it up.

  If you make this bigger, there will be  less  memory
  left  for  your system. The required size of the mfs
  file system depends on the size of the actual chroot
  environment.

                    Configuring sshd
                    ----------------

  We  use  key  authentication  to  get  access to the
  chroot.

  The chrooted ssh shell is made easy by the  features
  sshd  offers.  We  only  need  to  add  some  chroot
  configuration to sshd.

  Add these lines to sshd_config:

    Match Group chroot
        ChrootDirectory /chroot
        AuthorizedKeysFile /chroot/home/%u/.ssh/authorized_keys
        PasswordAuthentication no

                         Thanks
                         ------

  The example build script mentioned above is based on
  the        work        on       arnor.org,       see
  https://arnor.org/chroot/how_to_setup_shell_chroot_OpenBSD.txt.

  [^1]  The  example  build  script can be found here:
  gopher://box.matto.nl/0/ssh-chroot.txt