LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-23-2003, 03:22 PM   #1
ixion
Member
 
Registered: Dec 2002
Location: USA
Distribution: SuSE, CentOS, Gentoo
Posts: 166

Rep: Reputation: 30
chroot how much?


I have Apache with SSL and PHP support running in a chrooted environment on my web box. I am also running Squirrelmail from within the chroot jail. I am not, however, running courier-imap, fetchmail, or procmail in any jailed environment. Does running a mix of programs (in and out of the jail) that coordinate together compromise the security measure of a chrooted jail? Should I try to get courier-imap, fetchmail, and procmail all to run within that same jail?

Also, I've heard that a chroot should be an entirely seperate partition altogether. Is this true?
 
Old 05-24-2003, 08:54 AM   #2
markus1982
Senior Member
 
Registered: Aug 2002
Location: Stuttgart (Germany)
Distribution: Debian/GNU Linux
Posts: 1,467

Rep: Reputation: 46
Re: chroot how much?

Quote:
I have Apache with SSL and PHP support running in a chrooted environment on my web box. I am also running Squirrelmail from within the chroot jail.
Well did you TEST all functionality? Like can you still use PHP's mail function? Do MySQL connects work? Are you also using perl? Which Apache and PHP version are you using? What software did you install in the chroot for forwarding mail?
Quote:
I am not, however, running courier-imap, fetchmail, or procmail in any jailed environment. Does running a mix of programs (in and out of the jail) that coordinate together compromise the security measure of a chrooted jail? Should I try to get courier-imap, fetchmail, and procmail all to run within that same jail?
Well you can think of a jail as a directory subtree. The more you install in this subtree the more you loose security. Remember the benefits of a chroot: minimum access to software, etc. If however you have a LOT of software within the chroot you loose system security.

Applications can cooperate fine if they are partly in chrooted environments. If you have set up those chroots correctly then it will be no problem at all ... you shouldn't notice anything at least :-)

Running fetchmail chrooted? Well that makes no sense to me honestly, except you poll all the time (which would make fetchmail a daemon in that way). Regarding chrooting courier-imap you have to think of the mail directory for that user and the authentification ...
Quote:
Also, I've heard that a chroot should be an entirely seperate partition altogether. Is this true?
It's good practice ...

Last edited by markus1982; 05-24-2003 at 08:55 AM.
 
Old 05-24-2003, 03:22 PM   #3
ixion
Member
 
Registered: Dec 2002
Location: USA
Distribution: SuSE, CentOS, Gentoo
Posts: 166

Original Poster
Rep: Reputation: 30
Re: Re: chroot how much?

Quote:
Originally posted by markus1982
Well did you TEST all functionality? Like can you still use PHP's mail function? Do MySQL connects work? Are you also using perl? Which Apache and PHP version are you using? What software did you install in the chroot for forwarding mail?
I can use Squirrelmail flawlessly. I compliled PHP without MySQL support. It was not needed for just using Squirrelmail I don't use anything for forwarding mail in the chroot. I have created home directories under the chroot to store mail in. Btw, how can I tell that everything is running truelly within the chroot?

Quote:

Well you can think of a jail as a directory subtree. The more you install in this subtree the more you loose security. Remember the benefits of a chroot: minimum access to software, etc. If however you have a LOT of software within the chroot you loose system security.
Very good point. Answered my question.
 
Old 05-24-2003, 04:28 PM   #4
markus1982
Senior Member
 
Registered: Aug 2002
Location: Stuttgart (Germany)
Distribution: Debian/GNU Linux
Posts: 1,467

Rep: Reputation: 46
Re: Re: Re: chroot how much?

Quote:
Btw, how can I tell that everything is running truelly within the chroot?
get the process id of your daemon (httpd), ls -l /proc/<pid>/

Example:
Quote:
debian:~# ps auxw | grep postfix
postfix 17965 0.0 0.6 2528 1080 ? S May23 0:00 [nqmgr]
postfix 22168 0.0 0.6 2472 988 ? S 23:23 0:00 [pickup]
postfix 2455 0.0 1.0 4288 1668 ? S 23:27 0:00 [smtpd]
root 17383 0.0 0.2 1332 424 pts/0 S 23:28 0:00 grep postfix
debian:~# ls -l /proc/22168/
total 0
-r--r--r-- 1 root root 0 May 24 23:28 cmdline
lrwxrwxrwx 1 root root 0 May 24 23:28 cwd -> /var/spool/postfix
-r-------- 1 root root 0 May 24 23:28 environ
lrwxrwxrwx 1 root root 0 May 24 23:28 exe -> /usr/lib/postfix/pickup
dr-x------ 2 root root 0 May 24 23:28 fd
-r--r--r-- 1 root root 0 May 24 23:28 maps
-rw------- 1 root root 0 May 24 23:28 mem
-r--r--r-- 1 root root 0 May 24 23:28 mounts
lrwxrwxrwx 1 root root 0 May 24 23:28 root -> /var/spool/postfix
-r--r--r-- 1 root root 0 May 24 23:28 stat
-r--r--r-- 1 root root 0 May 24 23:28 statm
-r--r--r-- 1 root root 0 May 24 23:28 status
debian:~#
 
Old 05-29-2003, 04:28 PM   #5
ixion
Member
 
Registered: Dec 2002
Location: USA
Distribution: SuSE, CentOS, Gentoo
Posts: 166

Original Poster
Rep: Reputation: 30
What output should it have, and what shouldn't it? Should the absolute path show, or the chrooted path? IE, if apache is chrooted in /var/apache, then should the processes show '/var/apache/bin/httpd' or '/bin/httpd' ?

EDIT:
# ls -l /proc/1296
total 0
-r--r--r-- 1 root root 0 May 29 16:32 cmdline
lrwxrwxrwx 1 root root 0 May 29 16:32 cwd -> /var/export/chroots/www4
-r-------- 1 root root 0 May 29 16:32 environ
lrwxrwxrwx 1 root root 0 May 29 16:32 exe -> /var/export/chroots/www4/apache/bin/httpd
dr-x------ 2 root root 0 May 29 16:32 fd
-r--r--r-- 1 root root 0 May 29 16:32 maps
-rw------- 1 root root 0 May 29 16:32 mem
-r--r--r-- 1 root root 0 May 29 16:32 mounts
lrwxrwxrwx 1 root root 0 May 29 16:32 root -> /var/export/chroots/www4
-r--r--r-- 1 root root 0 May 29 16:32 stat
-r--r--r-- 1 root root 0 May 29 16:32 statm
-r--r--r-- 1 root root 0 May 29 16:32 status


So far all the apache processes show this. Does it appear to be chrooted fully?

Last edited by ixion; 05-29-2003 at 04:30 PM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
chroot help Smokey Slackware 15 02-24-2013 11:32 PM
sudo /usr/bin/chroot /home/chroot /bin/su - xxx| /bin/su: user xxx does not exist saavik Linux - General 3 07-04-2007 10:30 AM
chRoot SpaceCadet Linux - Networking 3 08-14-2003 05:29 AM
Chroot chamkila Linux - General 1 06-13-2003 05:46 AM
Better than chroot? radnix Linux - Security 5 12-20-2002 06:55 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 04:51 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration