A user requires shell access to an Ubuntu server from the WAN side. There are many shell accounts with simple passwords. So shell port (port 22) is blocked in the firewall. For my WAN side user I am planning to run a ssh server in a Debian chroot, and open its port in the firewall. If this kind of setup is feasible, what is the best way of achieving it? 
Chroot debian squeeze for shell access
ubuntu;debian;ssh;chroot
Single ssh serverIf the only reason you're planning to run an SSH server in a chroot is to restrict password authentication to some users, you don't need that: you can tell sshd to allow passwords only for a whitelist of users. In /etc/ssh/sshd_config, use a Match directive:PasswordAuthentication NoMatch User trusted_user_1,trusted_user_2    PasswordAuthentication yesIf you do want to chroot some users, you can still run a single ssh daemon, and use a ChrootDirectory directive in sshd_config (within the scope of a Match directive).Two ssh servers, listening on different addressesYou can have two ssh daemons listening on the same port, if they're listening on different addresses. Put a ListenAddress directive in each /etc/ssh/sshd_config, each with the IP address(es) you want that server to listen on (listen on, not listen to, i.e. these are addresses of your server's network interfaces). This is of limited applicability, only if your server machine is the node doing the LAN/WAN filtering. It also means that things like ssh localhost won't be transparent (you can still access the daemon that's not listening on localhost with ssh -b).Two ssh servers, listening on different portsYou can make the ssh daemon in the chroot listen on a different port, with the Port directive in /etc/ssh/sshd_config. Keep blocking port 22 from outside on your firewall and don't block the other port you selected for the chroot sshd.Two ssh servers, routing performed by the firewallIf you have two daemons listening on different ports (as above), you can still give the illusion that they're both listening on port 22. For example make the chrooted ssh daemon listen on port 2201, and redirect traffic coming on port 22 on eth1 to port 2201:iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 22 -j REDIRECT --to-ports 2201Then ssh connections from localhost or over eth0 to port 22 will reach the non-chrooted server, while ssh connections over eth1 to port 22 will reach the chrooted server. Connections on port 2201 will reach the chrooted server. You can use other criteria than -i eth, for example ! -s 10.1.0.0/16 ! -s 127.0.0.0/8 to match everything with a source address other than 10.1.x.y or loopback.