Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] chrootizing spells into a chroot for secure web serving with thttpd

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] chrootizing spells into a chroot for secure web serving with thttpd
  • Date: Fri, 14 May 2004 08:45:48 -0700

Not really. That's to provide a different BUILD file for spells that
want to chroot themselves as part of the cast process.

I've just been having the spells chroot whenever possible. Non-chrooted
spell versions are not advisable if they can be chrooted.

I haven't run into any issues with spells that have been chrooted such
as bind and ntp to warrant a non-chroot option. Should we give the user
the choice? For thttpd, they have the choice for example in
/etc/sysconfig/thttpd. That could easily be done for ntp and bind as
well, although I don't see the point on those two. thttpd would
legitimately need a choice since people may want to enable access to
system programs for cgi execution.

Looking at the bug, I can see the intent, but I'd rather not to have to
require a recast to change from chroot to non-chroot, hence the
/etc/sysconfig/thttpd flag to set chroot or not which just requires a
telinit run thttpd restart.

Seth

On Fri, May 14, 2004 at 12:17:18AM -0700, Andrew wrote:
> Does this stuff have anything to do with the work left over from bug
> bug 3199?
>
> http://bugs.sourcemage.org/show_bug.cgi?id=3199
>
> On Thu, May 13, 2004 at 12:29:50AM -0700, Seth Alan Woolley wrote:
> > On Thu, May 13, 2004 at 08:39:29AM +0200, Vladim?r Marek wrote:
> > > > > Since there seems to be a long silence, I thought I'd break it with
> > > > > my
> > > > > latest project. Since I lost my previous chroot environment in a
> > > > > harddrive crash, I thought I'd try to do it in an automated way this
> > > > > time.
> > >
> > > Great news, possibility to run certain serveces in chroot would be
> > > really great.
> >
> > We try to have all services do this by default, and if not, at least use
> > privilege separation as much as possible. thttpd, ntpd, bind, vsftpd,
> > sshd, all follow this philosophy. Right now, all services running on my
> > personal server except apache for a couple php websites are secured in
> > this
> > manner.
> >
> > >
> > > > > I wrote a script that installs spells into a chroot environement
> > > > > from
> > > > > source cache:
> > > > >
> > > > > http://seth.positivism.org/files/chrootize
> > > > >
> > > > > http://seth.positivism.org/files/chrootize-example
> > > > >
> > > > > It uses the dynamic linking checker ldd to recursively follow
> > > > > dependencies.
> > >
> > > As I went only quickly through your source, it basically means that you
> > > unpack allready compiled spell from cache to arbitrary directory and
> > > follow all dll dependencies ?
> >
> > This is exactly what it does. It gets you to the point that you can
> > then install sorcery if you wanted and run sorcery completely within the
> > chroot environment if you so choose. Limited bootstrapping, not a
> > complete solution like sorcery is.
> >
> > Once you have sorcery installed, you could rebuild and change your
> > dependencies, like use xfree86-libs instead of a full X server.
> >
> > >
> > > > > I got perl, bash, and GD working in a chroot with the above method.
> > > > > A
> > > > > clean chroot that needed perl is in the example.
> > > > >
> > > > > Just needed to first grab the files: passwd, shadow, group, and
> > > > > ld.so.conf from /etc and copy them over into the chroot; then run
> > > > > the
> > > > > mkbusybox script to get a basic cli from your already casted
> > > > > busybox;
> > > > > then weed out passwd, etc entries for every user you don't need;
> > > > > then
> > > > > run the chrootize script on what you need; then lastly chroot in
> > > > > and run
> > > > > ldconfig.
> > > + delete all unnecessary ld.so.conf entries I would say
> >
> > Yes, although ldconfig ignores them if there's nothing in them. The
> > security risk is minimal for having extra directories in there.
> >
> > >
> > > > > I then installed thttpd and set it to my chroot directory, gave it
> > > > > a cgi
> > > > > pattern of '**.cgi' in /etc/sysconfig/thttpd and perl worked like a
> > > > > charm.
> > > > >
> > > > > I just set my htdoc path to be the same as the root for the chroot,
> > > > > but
> > > > > if you want to hide your chroot files, you can put it anywhere
> > > > > within
> > > > > the chroot and use thttpd's -dd (datadir) argument.
> > > > >
> > > > > Worry about the complexity of securing apache? I find thttpd is so
> > > > > much
> > > > > simpler to lock down. Then again, no module mess, either (though
> > > > > you
> > > > > may want to use the 'feature' of apache's modules).
> > >
> > > Since I am prividing subversion repository through ssh, I would like to
> > > chroot ssh and subversion. Do you think it's worth ?
> >
> > ssh is already privilege separated as much as possible. If you want to
> > chroot ssh accesses, you could do this, I believe, although I haven't
> > tried it. One simple way to have ssh chroot after login (instead of
> > running the daemon within a chroot to begin with) is to set the profile
> > script of your user shell to run a setuid binary that is able to chroot
> > and switch back to the user it started under and return exit code 1 when
> > exiting so as to force a logout. It's a crazy idea, but it might work.
> > Chrooting the daemon might be easier, but it would require you have
> > multiple copies of sshd running, possibly on separate ports if you only
> > have one IP address (might be the safest route since you can have
> > separate user accounts within the chroot environment).
> >
> > With a grsecurity patched kernel you can provide much more detailed
> > control over what happens in a chroot jail.
> >
> > >
> > > > and the main reason I installed busybox was to have a working ldconfig
> > > > ... but if you have glibc installed, ldconfig is installed to /sbin.
> > > >
> > > > So you don't even need busybox.
> > >
> > > Are you sure you will be able to enter the chrooted environment without
> > > busybox ? I don't want to copy my whole system to chroot :) Well, best
> > > is to try myself :)
> >
> > Yep, it will work fine. A lot of chroot environments have nothing in
> > them except data files (for example, anonymous ftp servers often used
> > this trick).
> >
> > >
> > > > I might modify the chrootize script to automatically ldconfig the
> > > > environment and setup the /etc files, although since Hamish's iso
> > > > work,
> > > > most of the /etc stuff is handled pretty well automatically.
> > > >
> > > > Seth
> > > >
> > > --
> > > Neuron
> >
> >
> >
> > > _______________________________________________
> > > SM-Discuss mailing list
> > > SM-Discuss AT lists.ibiblio.org
> > > http://lists.ibiblio.org/mailman/listinfo/sm-discuss
> >
> >
> > --
> > Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
> > Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A
> > http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
> > Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org
>
>
>
> > _______________________________________________
> > SM-Discuss mailing list
> > SM-Discuss AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>
>
> --
> __________________________________________________________________________
> |Andrew D. Stitt | astitt at sourcemage.org |
> |irc: afrayedknot | afrayedknot at t.armory.com |
> |aim: thefrayedknot or iteratorplusplus | |
> |Sorcery Team Lead, Porting Team Lead | |
> |Grimoire Guru ham/smgl | ftp://t.armory.com |
> |Author and Maintainer of Prometheus | |
> --------------------------------------------------------------------------
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgpFjD1mkfG7y.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page