Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] chrootizing spells into a chroot for secure web serving with thttpd

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] chrootizing spells into a chroot for secure web serving with thttpd
  • Date: Sun, 9 May 2004 01:21:11 -0700

On Sun, May 09, 2004 at 12:21:04AM -0700, Seth Alan Woolley wrote:
> Since there seems to be a long silence, I thought I'd break it with my
> latest project. Since I lost my previous chroot environment in a
> harddrive crash, I thought I'd try to do it in an automated way this
> time.
>
> I wrote a script that installs spells into a chroot environement from
> source cache:
>
> http://seth.positivism.org/files/chrootize
>
> http://seth.positivism.org/files/chrootize-example
>
> It uses the dynamic linking checker ldd to recursively follow
> dependencies.
>
> I got perl, bash, and GD working in a chroot with the above method. A
> clean chroot that needed perl is in the example.
>
> Just needed to first grab the files: passwd, shadow, group, and
> ld.so.conf from /etc and copy them over into the chroot; then run the
> mkbusybox script to get a basic cli from your already casted busybox;
> then weed out passwd, etc entries for every user you don't need; then
> run the chrootize script on what you need; then lastly chroot in and run
> ldconfig.
>
> I then installed thttpd and set it to my chroot directory, gave it a cgi
> pattern of '**.cgi' in /etc/sysconfig/thttpd and perl worked like a
> charm.
>
> I just set my htdoc path to be the same as the root for the chroot, but
> if you want to hide your chroot files, you can put it anywhere within
> the chroot and use thttpd's -dd (datadir) argument.
>
> Worry about the complexity of securing apache? I find thttpd is so much
> simpler to lock down. Then again, no module mess, either (though you
> may want to use the 'feature' of apache's modules).

Also forgot to link this:

http://seth.positivism.org/files/mkbusybox

and the main reason I installed busybox was to have a working ldconfig
... but if you have glibc installed, ldconfig is installed to /sbin.

So you don't even need busybox.

I might modify the chrootize script to automatically ldconfig the
environment and setup the /etc files, although since Hamish's iso work,
most of the /etc stuff is handled pretty well automatically.

Seth

P.S. My source mirror should be back up soon -- it's refreshing as we
speak.

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgp72aWWpL4Us.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page