[SM-Discuss] chrootizing spells into a chroot for secure web serving with thttpd
Seth Alan Woolley
seth at positivism.org
Sun May 9 04:21:11 EDT 2004
On Sun, May 09, 2004 at 12:21:04AM -0700, Seth Alan Woolley wrote:
> Since there seems to be a long silence, I thought I'd break it with my
> latest project. Since I lost my previous chroot environment in a
> harddrive crash, I thought I'd try to do it in an automated way this
> time.
>
> I wrote a script that installs spells into a chroot environement from
> source cache:
>
> http://seth.positivism.org/files/chrootize
>
> http://seth.positivism.org/files/chrootize-example
>
> It uses the dynamic linking checker ldd to recursively follow
> dependencies.
>
> I got perl, bash, and GD working in a chroot with the above method. A
> clean chroot that needed perl is in the example.
>
> Just needed to first grab the files: passwd, shadow, group, and
> ld.so.conf from /etc and copy them over into the chroot; then run the
> mkbusybox script to get a basic cli from your already casted busybox;
> then weed out passwd, etc entries for every user you don't need; then
> run the chrootize script on what you need; then lastly chroot in and run
> ldconfig.
>
> I then installed thttpd and set it to my chroot directory, gave it a cgi
> pattern of '**.cgi' in /etc/sysconfig/thttpd and perl worked like a
> charm.
>
> I just set my htdoc path to be the same as the root for the chroot, but
> if you want to hide your chroot files, you can put it anywhere within
> the chroot and use thttpd's -dd (datadir) argument.
>
> Worry about the complexity of securing apache? I find thttpd is so much
> simpler to lock down. Then again, no module mess, either (though you
> may want to use the 'feature' of apache's modules).
Also forgot to link this:
http://seth.positivism.org/files/mkbusybox
and the main reason I installed busybox was to have a working ldconfig
... but if you have glibc installed, ldconfig is installed to /sbin.
So you don't even need busybox.
I might modify the chrootize script to automatically ldconfig the
environment and setup the /etc files, although since Hamish's iso work,
most of the /etc stuff is handled pretty well automatically.
Seth
P.S. My source mirror should be back up soon -- it's refreshing as we
speak.
--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/sm-discuss/attachments/20040509/9a9c902e/attachment.bin
More information about the SM-Discuss
mailing list