Skip to Content.
Sympa Menu

sm-discuss - [SM-Discuss] chrootizing spells into a chroot for secure web serving with thttpd

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: [SM-Discuss] chrootizing spells into a chroot for secure web serving with thttpd
  • Date: Sun, 9 May 2004 00:21:04 -0700

Since there seems to be a long silence, I thought I'd break it with my
latest project. Since I lost my previous chroot environment in a
harddrive crash, I thought I'd try to do it in an automated way this
time.

I wrote a script that installs spells into a chroot environement from
source cache:

http://seth.positivism.org/files/chrootize

http://seth.positivism.org/files/chrootize-example

It uses the dynamic linking checker ldd to recursively follow
dependencies.

I got perl, bash, and GD working in a chroot with the above method. A
clean chroot that needed perl is in the example.

Just needed to first grab the files: passwd, shadow, group, and
ld.so.conf from /etc and copy them over into the chroot; then run the
mkbusybox script to get a basic cli from your already casted busybox;
then weed out passwd, etc entries for every user you don't need; then
run the chrootize script on what you need; then lastly chroot in and run
ldconfig.

I then installed thttpd and set it to my chroot directory, gave it a cgi
pattern of '**.cgi' in /etc/sysconfig/thttpd and perl worked like a
charm.

I just set my htdoc path to be the same as the root for the chroot, but
if you want to hide your chroot files, you can put it anywhere within
the chroot and use thttpd's -dd (datadir) argument.

Worry about the complexity of securing apache? I find thttpd is so much
simpler to lock down. Then again, no module mess, either (though you
may want to use the 'feature' of apache's modules).

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgpKVwSv5_xuz.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page