BZFS in a chroot jail - Revision history

Samjetski: add to category

2008-09-13T07:17:58Z

add to category

← Older revision		Revision as of 07:17, 13 September 2008
Line 217:		Line 217:
	[[Category:Server]]		[[Category:Server]]
	[[Category:Server Security]]		[[Category:Server Security]]
			[[Category:Tutorials]]

68.17.255.141: Sticky bit is +t. Completely different from SUID.

2008-08-19T22:20:10Z

Sticky bit is +t. Completely different from SUID.

← Older revision		Revision as of 22:20, 19 August 2008
Line 134:		Line 134:
	== More Security ==		== More Security ==

	Since you have to execute chroot as root, bzfs will run as root – which is not what we want. We can force bzfs to run as nobody by changing his ownership to nobody, and setting the ~~sticky~~ bit on him. This way, when root executes /chroot/bzflag/bin/bzfs – it is executed as nobody, and therefore has very little privileges on the system.		Since you have to execute chroot as root, bzfs will run as root – which is not what we want. We can force bzfs to run as nobody by changing his ownership to nobody, and setting the SUID bit on him. This way, when root executes /chroot/bzflag/bin/bzfs – it is executed as nobody, and therefore has very little privileges on the system.

	This is how we do that:		This is how we do that:

Constitution: correct capitalization

2007-04-21T04:37:50Z

correct capitalization

← Older revision		Revision as of 04:37, 21 April 2007
Line 9:		Line 9:
	Before attempting to set up BZFS in a chroot jail it is best to have a little background in using the chroot command. The best place to start is reading the man page		Before attempting to set up BZFS in a chroot jail it is best to have a little background in using the chroot command. The best place to start is reading the man page
	man chroot		man chroot
	but the basic concept is to run a program in a directory and force it to think that it is the root (the top) of the filesystem (the ‘sandbox’ or ‘jail’), so that if the application was ever compromised, only it’s folder would be accessible to the attacker and not the entire filesystem. User root, or any program with root privileges can break out of a chroot jail. ~~USers~~ should be ware that a badly configured chroot jail might even be a larger security problem then not running one. The application jk_check from http://olivier.sessink.nl/jailkit does checks to verify if your chroot jail is safe.		but the basic concept is to run a program in a directory and force it to think that it is the root (the top) of the filesystem (the ‘sandbox’ or ‘jail’), so that if the application was ever compromised, only it’s folder would be accessible to the attacker and not the entire filesystem. User root, or any program with root privileges can break out of a chroot jail. Users should be ware that a badly configured chroot jail might even be a larger security problem then not running one. The application jk_check from http://olivier.sessink.nl/jailkit does checks to verify if your chroot jail is safe.

	Before a program can be run in a jail, the user must make sure that the program has all dependencies that it may need. This means creating a smaller copy of the root filesystem so that the program can access the files that it needs, and knows where to find them. This means that if a program requires a library in /lib, then we will need a lib directory with those libraries in our jail. (if this is confusing – hang in there, you will see an example below).		Before a program can be run in a jail, the user must make sure that the program has all dependencies that it may need. This means creating a smaller copy of the root filesystem so that the program can access the files that it needs, and knows where to find them. This means that if a program requires a library in /lib, then we will need a lib directory with those libraries in our jail. (if this is confusing – hang in there, you will see an example below).

Joevano: moved category

2007-03-24T01:42:15Z

moved category

← Older revision		Revision as of 01:42, 24 March 2007
Line 216:		Line 216:

	[[Category:Server]]		[[Category:Server]]
	[[Category:~~Server_security~~]]		[[Category:Server Security]]

JeffM2501: /* Overview */

2007-02-20T21:17:13Z

Overview

← Older revision		Revision as of 21:17, 20 February 2007
Line 2:		Line 2:

	==Overview==		==Overview==
	Installing the BZFLAG Server (bzfs) in a ‘sandbox’ or a ‘jail’ on Linux by using the features provided with chroot is an advanced method for setting up a server. It offers additional security for the hosting server. For general information on setting up a server see [[~~Creating_A_Server~~]].		Installing the BZFLAG Server (bzfs) in a ‘sandbox’ or a ‘jail’ on Linux by using the features provided with chroot is an advanced method for setting up a server. It offers additional security for the hosting server. For general information on setting up a server see [[Creating A Server]].

	This method has been tested on Redhat 8 and 9 systems. Other Linux distributions should work in a similar manner.		This method has been tested on Redhat 8 and 9 systems. Other Linux distributions should work in a similar manner.

JeffM2501 at 21:03, 20 February 2007

2007-02-20T21:03:54Z

← Older revision		Revision as of 21:03, 20 February 2007
Line 1:		Line 1:
			BZFS in a chroot jail is a concept where a [[BZFS]] server is run on a host computer in a very secure environment, preventing it from having access to any other parts of the host system.

	==Overview==		==Overview==
	Installing the BZFLAG Server (bzfs) in a ‘sandbox’ or a ‘jail’ on Linux by using the features provided with chroot is an advanced method for setting up a server. It offers additional security for the hosting server. For general information on setting up a server see [[Creating_A_Server]].		Installing the BZFLAG Server (bzfs) in a ‘sandbox’ or a ‘jail’ on Linux by using the features provided with chroot is an advanced method for setting up a server. It offers additional security for the hosting server. For general information on setting up a server see [[Creating_A_Server]].

	This has been tested on Redhat 8 and 9 systems~~, although it should be fairly similar, if not identical on other~~ Linux distributions.		This method has been tested on Redhat 8 and 9 systems. Other Linux distributions should work in a similar manner.

	~~If when you read it you see some errors or had some issues not mentioned~~ in ~~here and have the answers to them, you can e-mail me or create~~ a new section at the end with the updates (after my signature - and sign the updates yourself so I know whom to credit if the new info gets merged). I can always merge them into the doc or create a new section (keeping the credits of course) for smoother reading at a later date.

	~~OK - let's get started..~~.

	== Background ==		==Background==
			Before attempting to set up BZFS in a chroot jail it is best to have a little background in using the chroot command. The best place to start is reading the man page
			man chroot
			but the basic concept is to run a program in a directory and force it to think that it is the root (the top) of the filesystem (the ‘sandbox’ or ‘jail’), so that if the application was ever compromised, only it’s folder would be accessible to the attacker and not the entire filesystem. User root, or any program with root privileges can break out of a chroot jail. USers should be ware that a badly configured chroot jail might even be a larger security problem then not running one. The application jk_check from http://olivier.sessink.nl/jailkit does checks to verify if your chroot jail is safe.

	Before ~~we begin,~~ a ~~little background~~ in ~~using the chroot command is needed. The best place to start is reading the man page (<code>man chroot</code>)~~, ~~but basically~~ the ~~concept is to run a program in a folder and force~~ the program ~~to think~~ that it is the root ~~(the top) of the~~ filesystem ~~(the ‘sandbox’ or ‘jail’),~~ so that if the ~~application was ever compromised (like~~ the ~~shell access vulnerability scare~~ that ~~went around for bzfs a little while ago)~~, ~~only it’s folder would be accessible~~ to ~~the attacker and not the entire filesystem~~. ~~User root, or any~~ program ~~with root privileges can break out of~~ a ~~chroot jail. And beware~~, a ~~badly configured chroot~~ jail ~~might even be a security problem! jk_check from jailkit~~ (~~http://olivier.sessink.nl/jailkit) does check~~ if ~~your chroot jail~~ is ~~safe~~.		Before a program can be run in a jail, the user must make sure that the program has all dependencies that it may need. This means creating a smaller copy of the root filesystem so that the program can access the files that it needs, and knows where to find them. This means that if a program requires a library in /lib, then we will need a lib directory with those libraries in our jail. (if this is confusing – hang in there, you will see an example below).

	Before we can run a program in a jail, we have to make sure that it has everything it needs to run, and this means creating a mini root filesystem so that the program can access the files that it needs, and knows where to find them. This means that if a program requires a library in /lib, then we will need a lib directory with those libraries in our jail. (if this is confusing – hang in there, you will see an example below).


	== Just tell me how to do it!! ==		== Just tell me how to do it!! ==

Line 210:		Line 208:
	I hope this is useful to people out there, as a bit of time went into it to figure out just which files are needed to run bzfs in a jail. I started out with the entire /lib copied over, and got it working with the minimal files listed above.		I hope this is useful to people out there, as a bit of time went into it to figure out just which files are needed to run bzfs in a jail. I started out with the entire /lib copied over, and got it working with the minimal files listed above.

	~~See you out there~~

	~~Quol (quolsimo@hotmail~~.~~com)~~		==See also==
			[[BZFS]]

			==External Links==
			http://olivier.sessink.nl/jailkit

	[[Category:Server]]		[[Category:Server]]
	[[Category:~~Support~~]]		[[Category:Server_security]]

JeffM2501: /* Introduction */

2007-02-20T20:46:43Z

Introduction

← Older revision		Revision as of 20:46, 20 February 2007
Line 1:		Line 1:
	== ~~Introduction~~ ==		==Overview==
			Installing the BZFLAG Server (bzfs) in a ‘sandbox’ or a ‘jail’ on Linux by using the features provided with chroot is an advanced method for setting up a server. It offers additional security for the hosting server. For general information on setting up a server see [[Creating_A_Server]].
	~~The purpose of this doc is to show how to install~~ the BZFLAG Server (bzfs) in a ‘sandbox’ or a ‘jail’ on Linux by using the features provided with chroot. For general information on setting up a server see [[Creating_A_Server]].

	This has been tested on Redhat 8 and 9 systems, although it should be fairly similar, if not identical on other Linux distributions.		This has been tested on Redhat 8 and 9 systems, although it should be fairly similar, if not identical on other Linux distributions.

Brad: spelling

2007-02-20T15:36:24Z

spelling

← Older revision		Revision as of 15:36, 20 February 2007
Line 193:		Line 193:
	I also keep all my (not mine, but the ones I downloaded :) ) in a map dir like: /chroot/bzflag/maps		I also keep all my (not mine, but the ones I downloaded :) ) in a map dir like: /chroot/bzflag/maps

	You may want to create some startup scripts that start your server up automatically in case it reboots. I use a separate rc file for this for simplicity. One could create an init script and then use chkconfig to call it in rc3.d, but I am ~~lazzy~~ and haven’t done that.		You may want to create some startup scripts that start your server up automatically in case it reboots. I use a separate rc file for this for simplicity. One could create an init script and then use chkconfig to call it in rc3.d, but I am lazy and haven’t done that.

	I simply declared in my rc.local (which is loaded last anyways and as such all network systems will be available when it is called) to execute rc.bzfs which I have in /etc/rc.d/rc.bzfs.		I simply declared in my rc.local (which is loaded last anyways and as such all network systems will be available when it is called) to execute rc.bzfs which I have in /etc/rc.d/rc.bzfs.

Ts: `man chroot` instead of ''man chroot''

2007-02-20T15:18:19Z

<code>man chroot</code> instead of ''man chroot''

← Older revision		Revision as of 15:18, 20 February 2007
Line 11:		Line 11:
	== Background ==		== Background ==

	Before we begin, a little background in using the chroot command is needed. The best place to start is reading the man page (''man chroot''), but basically the concept is to run a program in a folder and force the program to think that it is the root (the top) of the filesystem (the ‘sandbox’ or ‘jail’), so that if the application was ever compromised (like the shell access vulnerability scare that went around for bzfs a little while ago), only it’s folder would be accessible to the attacker and not the entire filesystem. User root, or any program with root privileges can break out of a chroot jail. And beware, a badly configured chroot jail might even be a security problem! jk_check from jailkit (http://olivier.sessink.nl/jailkit) does check if your chroot jail is safe.		Before we begin, a little background in using the chroot command is needed. The best place to start is reading the man page (<code>man chroot</code>), but basically the concept is to run a program in a folder and force the program to think that it is the root (the top) of the filesystem (the ‘sandbox’ or ‘jail’), so that if the application was ever compromised (like the shell access vulnerability scare that went around for bzfs a little while ago), only it’s folder would be accessible to the attacker and not the entire filesystem. User root, or any program with root privileges can break out of a chroot jail. And beware, a badly configured chroot jail might even be a security problem! jk_check from jailkit (http://olivier.sessink.nl/jailkit) does check if your chroot jail is safe.

	Before we can run a program in a jail, we have to make sure that it has everything it needs to run, and this means creating a mini root filesystem so that the program can access the files that it needs, and knows where to find them. This means that if a program requires a library in /lib, then we will need a lib directory with those libraries in our jail. (if this is confusing – hang in there, you will see an example below).		Before we can run a program in a jail, we have to make sure that it has everything it needs to run, and this means creating a mini root filesystem so that the program can access the files that it needs, and knows where to find them. This means that if a program requires a library in /lib, then we will need a lib directory with those libraries in our jail. (if this is confusing – hang in there, you will see an example below).

Ts: Add to Server and Support categories

2007-02-20T15:12:57Z

Add to Server and Support categories

← Older revision		Revision as of 15:12, 20 February 2007
Line 214:		Line 214:

	Quol (quolsimo@hotmail.com)		Quol (quolsimo@hotmail.com)
			[[Category:Server]]
			[[Category:Support]]