Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

Since there seems to be a long silence, I thought I'd break it with my
latest project.  Since I lost my previous chroot environment in a
harddrive crash, I thought I'd try to do it in an automated way this
time.

I wrote a script that installs spells into a chroot environement from
source cache:

http://seth.positivism.org/files/chrootize

http://seth.positivism.org/files/chrootize-example

It uses the dynamic linking checker ldd to recursively follow
dependencies.

I got perl, bash, and GD working in a chroot with the above method.  A
clean chroot that needed perl is in the example.

Just needed to first grab the files: passwd, shadow, group, and
ld.so.conf from /etc and copy them over into the chroot; then run the
mkbusybox script to get a basic cli from your already casted busybox;
then weed out passwd, etc entries for every user you don't need; then
run the chrootize script on what you need; then lastly chroot in and run
ldconfig.

I then installed thttpd and set it to my chroot directory, gave it a cgi
pattern of '**.cgi' in /etc/sysconfig/thttpd and perl worked like a
charm.

I just set my htdoc path to be the same as the root for the chroot, but
if you want to hide your chroot files, you can put it anywhere within
the chroot and use thttpd's -dd (datadir) argument.

Worry about the complexity of securing apache?  I find thttpd is so much
simpler to lock down.  Then again, no module mess, either (though you
may want to use the 'feature' of apache's modules).

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8  3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgpKVwSv5_xuz.pgp
Description: PGP signature