LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
LinkBack Search this Thread
Old 11-01-2002, 11:36 AM   #1
markus1982
Senior Member
 
Registered: Aug 2002
Location: Stuttgart (Germany)
Distribution: Debian/GNU Linux
Posts: 1,467

Rep: Reputation: 45
(short) HOWTO: chrooting MySQL


This is just a short how-to, more information about chrooting MySQL can be obtained in these 2 threads:

mysqld doesn't chroot securely

chrooting mysql


Following the MySQL documentation mysqld can be run chrooted using the --chroot command line option. Chrooting however is not really done. In a chrooted area things outside of the area can't be accessed. Just place your databases-directory outside of the area and give it a try ... it WILL work, ergo chrooting is not completely done! So we don't rely on the program chrooting capabilities and use the "standard" method.

I've used the Binary Linux package (Intel libc6 systems) for this time. Steps to install the binary package chrooted:[list=1][*]add mysql user + group[*]create jail directories[*]set up chroot jail[*]install mysql binary package (to /server/mysql)[*]install mysql and test database[*]create /server/mysql/etc/my.cnf (mysql configuration)[*]adjust permissions[/list=1]

Script that does this for us:
Code:
#!/usr/bin/perl

# install MySQL chrooted
# base is the binary distribution of MySQL

system("chattr -i /etc/group /etc/gshadow /etc/passwd /etc/shadow");
system("groupadd mysql ; useradd -g mysql mysql -m -k /server/mysql -s /bin/false -d /server/mysql");
system("chattr +i /etc/group /etc/gshadow /etc/passwd /etc/shadow");
system("mkdir -p /server/mysql/dev /server/mysql/etc /server/mysql/tmp");
system("cp my.cnf /server/mysql/etc ; chown mysql:mysql /server/mysql/etc/my.cnf ; chmod 440 /server/mysql/etc/my.cnf");
system("cp mysql-*-pc-linux-gnu-i686.tar.gz /server");
chdir("/server");
system("tar xvfz mysql-*-pc-linux-*.tar.gz ; rm mysql-*-pc-linux-*.tar.gz");
system("mv mysql-*-pc-linux-* mysql/binary");
chdir("/server/mysql/binary");

open(FHANDLE, "/server/mysql/binary/bin/mysqlaccess");
@mysqlaccess = <FHANDLE>;
close(FHANDLE);

for ($i = 0; $i < scalar(@mysqlaccess); $i++) {
	if (@mysqlaccess[$i] =~ /\$MYSQL/) {
		@mysqlaccess[$i] = "\t\$MYSQL     = '/server/mysql/binary/bin/mysql'\n";
		last;}
}



open(FHANDLE, "/server/mysql/binary/bin/mysqlaccess");
print FHANDLE @mysqlaccess;
close(FHANDLE);

system("mv /server/mysql/etc/my.cnf /server/mysql/etc/config.cnf");
system("./scripts/mysql_install_db");
system("mv /server/mysql/etc/config.cnf /server/mysql/etc/my.cnf");
system("mv data ../databases");
system("chown -R root  /server/mysql/binary");
system("chown -R mysql /server/mysql/databases");
system("chgrp -R mysql /server/mysql/binary /server/mysql/databases");
system("chmod 777 /server/mysql/tmp ; chattr +t /server/mysql/tmp");
system("ln -s /server/mysql/tmp/mysql.sock /tmp/mysql.sock");
system("less /etc/passwd | grep mysql > /server/mysql/etc/passwd");
system("chmod 0444 /server/mysql/etc/passwd");
system("strip /server/mysql/binary/bin/* &> /dev/null");
system("chattr +i -R /server/mysql/etc");

system("mknod /server/mysql/dev/null c 1 3 ; chattr +i -R /server/mysql/dev");
Quote:
# my.cnf
# ----------------------------------------------------------------------
# MySQL client configuration (options will be passed to MySQL clients)
# ----------------------------------------------------------------------
[client]
port = 3306
socket = /tmp/mysql.sock
# ----------------------------------------------------------------------



# ----------------------------------------------------------------------
# MySQL server configuration
# ----------------------------------------------------------------------
[mysqld]
basedir = /binary
datadir = /databases
port = 3306
socket = /tmp/mysql.sock
tmpdir = /tmp/

local-infile = 0
safe-show-database
safe-user-create
server-id = 0
skip-innodb
skip-locking
skip-show-database

set-variable = interactive_timeout=3600
set-variable = key_buffer=256M
set-variable = max_allowed_packet=1M
set-variable = max_connections=1000
set-variable = myisam_sort_buffer_size=64M
set-variable = record_buffer=1M
set-variable = sort_buffer=1M
set-variable = table_cache=256
set-variable = thread_cache=8
set-variable = wait_timeout=3600
# ----------------------------------------------------------------------


[mysqldump]
quick
set-variable = max_allowed_packet=16M


[mysql]
no-auto-rehash


[isamchk]
set-variable = key_buffer=128M
set-variable = read_buffer=2M
set-variable = sort_buffer=128M
set-variable = write_buffer=2M

[myisamchk]
set-variable = key_buffer=128M
set-variable = read_buffer=2M
set-variable = sort_buffer=128M
set-variable = write_buffer=2M


[mysqlhotcopy]
interactive-timeout

You might want to do a ln -s /server/mysql/etc/my.cnf /etc/my.cnf and adjust the manpath configuration (/etc/man.config) and add the path for the mysql client programs (/server/mysql/binary/bin) to your $PATH variable ... for instance using /root/.bash_profile but this shouldn't be too much of a problem!

To startup the chrooted area you need to do chroot /server/mysql /binary/bin/mysqld --user=mysql & so you can write this in a startup script... or you can modify the safe_mysqld script a bit to run mysqld chrooted from there ...


More information regarding chrooting can be found at
You might also want to look at the grsecurity-kernel-patch!

Last edited by markus1982; 11-01-2002 at 11:46 AM.
 
Old 11-01-2002, 12:23 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,534
Blog Entries: 51

Rep: Reputation: 2603Reputation: 2603Reputation: 2603Reputation: 2603Reputation: 2603Reputation: 2603Reputation: 2603Reputation: 2603Reputation: 2603Reputation: 2603Reputation: 2603
Well done!

Markus, well done!
Not only have you shared with us your problem and thoughts on it, but giving back to the community presenting us with this howto is beyond expectations, really makes my day.

Thanks, unSpawn
 
Old 11-01-2002, 12:43 PM   #3
markus1982
Senior Member
 
Registered: Aug 2002
Location: Stuttgart (Germany)
Distribution: Debian/GNU Linux
Posts: 1,467

Original Poster
Rep: Reputation: 45
Wish I'd have the time to submit a complete howto, nevertheless hope this kind of information helps somebody out somehow
 
Old 11-07-2002, 08:07 PM   #4
needamiracle
Member
 
Registered: Apr 2002
Location: North Attleboro, MA
Distribution: RH 7.3
Posts: 106

Rep: Reputation: 15
I have to agree, I rarely read entire posts and will usually skip the over used smily face sections. Your post has been helpful and well presented. Thank you.
 
Old 11-16-2002, 12:21 PM   #5
markus1982
Senior Member
 
Registered: Aug 2002
Location: Stuttgart (Germany)
Distribution: Debian/GNU Linux
Posts: 1,467

Original Poster
Rep: Reputation: 45
I changed the my.cnf configuration a bit, more strength!
Code:
# ----------------------------------------------------------------------
# MySQL client configuration (options will be passed to  MySQL clients)
# ----------------------------------------------------------------------
[client]
port		= 3306
socket		= /tmp/mysql.sock
# ----------------------------------------------------------------------



# ----------------------------------------------------------------------
# MySQL server configuration
# ----------------------------------------------------------------------
[mysqld]
basedir		= /binary
datadir		= /databases
port		= 3306
pid-file	= /databases/mysql.pid
socket		= /tmp/mysql.sock
tmpdir		= /tmp/
user		= mysql

local-infile	= 0
safe-show-database
safe-user-create
server-id	= 0
skip-innodb
skip-locking
skip-show-database
skip-symlink

set-variable	= interactive_timeout=3600
set-variable	= key_buffer=256M
set-variable	= max_allowed_packet=1M
set-variable	= max_connections=1000
set-variable	= max_user_connections=100
set-variable	= myisam_sort_buffer_size=64M
set-variable	= record_buffer=1M
set-variable	= sort_buffer=1M
set-variable	= table_cache=256
set-variable	= thread_cache=8
set-variable	= wait_timeout=3600
# ----------------------------------------------------------------------


[mysqldump]
quick
set-variable	= max_allowed_packet=16M


[mysql]
no-auto-rehash


[isamchk]
set-variable	= key_buffer=128M
set-variable	= read_buffer=2M
set-variable	= sort_buffer=128M
set-variable	= write_buffer=2M

[myisamchk]
set-variable	= key_buffer=128M
set-variable	= read_buffer=2M
set-variable	= sort_buffer=128M
set-variable	= write_buffer=2M


[mysqlhotcopy]
interactive-timeout
Two addons:
- skip-symlink
- max_user_connections

Check http://www.mysql.com/doc/en/Security.html for more details on them!
 
Old 11-16-2002, 12:24 PM   #6
markus1982
Senior Member
 
Registered: Aug 2002
Location: Stuttgart (Germany)
Distribution: Debian/GNU Linux
Posts: 1,467

Original Poster
Rep: Reputation: 45
For a simple startup script you may want to use something like
Code:
#!/bin/sh

# chkconfig: 2345 90 90
# description: MySQL server

pid_file=/server/mysql/databases/mysql.pid


case "$1" in
  'restart')
	/etc/rc.d/init.d/mysql stop
	/etc/rc.d/init.d/mysql start
	;;

  'start')
	chroot /server/mysql /binary/bin/mysqld &
	touch /var/lock/subsys/mysql
	;;

  'stop')
	mysqld_pid=`cat $pid_file`
	echo "Killing MySQL-Server with pid $mysqld_pid"
	kill $mysqld_pid
	rm /var/lock/subsys/mysql
	;;

	*)
	echo "usage: $0 start|stop|restart"
	exit 1
	;;
esac
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Short MySQL Question The_Messiah Linux - Networking 2 03-28-2005 03:30 AM
FYI: mysql setup tutorial inl. chrooting markus1982 Linux - Security 0 03-07-2004 10:53 AM
chrooting howto urls markus1982 Linux - Security 0 01-19-2003 06:53 AM
chrooting mysql markus1982 Linux - Security 6 10-29-2002 09:22 AM
mysql howto? skeletal29 Linux - Software 2 05-11-2002 12:19 PM


All times are GMT -5. The time now is 06:43 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration