Jails...

Hecate

Has anyone set one of these up before?

dahamsta

You mean FTP jails or complete (shell) jails?

adam

moist

Do you want to run a service like bind or somthing in a chroot environment?
or are you talking about the FreeBSD kernel jail thingumy which basically runs another
virtual machine on the machine ?

Hecate

Yeah it's the FreeBSD implementation of Jail I was talking about; basically a few of us in college are thinking of running an IRC server within it.

Also; does chroot only restrict people to a certain directory structure (like their /home dir) ?

dahamsta

Yeah it's the FreeBSD implementation of Jail I was talking about; basically a few of us in college are thinking of running an IRC server within it.

Ah. I've never chrooted an app before, so I probably wouldn't be of any help to you. It's probably the same process, but I'd be worried about linking and that. Maybe have a look into the process for chrooting named (BIND), which is quite well documented (do a search on Google for "chroot named"?).

Also; does chroot only restrict people to a certain directory structure (like their /home dir) ?

Yip. You basically just create a directory structure with the tools that the user will need, and lock them into their home directory. For FTP, all that's really needed is 'ls'. You can use the tools themselves, or use some creative hard-linking to cut down on disk space.

adam

moist

Originally posted by Hecate
Yeah it's the FreeBSD implementation of Jail I was talking about; basically a few of us in college are thinking of running an IRC server within it.

Well, FreeBSD's jail would probably be overkill for just an IRC server, read the man page it
goes into a good deal of depth.
What your really doing is installing a complete FreeBSD installation into a particular directory
Then you tell the kernel to run a seperate virtual server from that directory, you need a different
IP address (AFAIK) to run it too, the kernel listens on both IP's and sends the info to whichever server...

Also; does chroot only restrict people to a certain directory structure (like their /home dir) ?

Its used to restrict a process to a particular directory.
It changes the root directory for the process to (say) /chroot the process is not able
to get outside that directory, because as far as its concerned it is /
Depending on your programme you may have to install libaries and stuff under /chroot.

For example the following ircd is dynamically linked and needs the following libs...


# ldd /usr/local/sbin/ircd
/usr/local/sbin/ircd:
libz.so.2 => /usr/lib/libz.so.2 (0x28090000)
libm.so.2 => /usr/lib/libm.so.2 (0x2809d000)
libcrypt.so.2 => /usr/lib/libcrypt.so.2 (0x280b8000)
libc.so.4 => /usr/lib/libc.so.4 (0x280d1000)


so I would have to copy them as follows...

cp /usr/lib/libz.so.2 /chroot/usr/lib/libz.so.2
cp /usr/lib/libm.so.2 /chroot/usr/lib/libm.so.2
cp /usr/lib/libcrypt.so.2 /chroot/usr/lib/libcrypt.so.2
cp /usr/lib/libc.so.4 /chroot/usr/lib/libc.so.4

and of course any other configs that you need.

Now, the dificult thing is that chroot has to be run by root, so you have to use su,
unless you want to run your ircd as root >:|

As an example try running bash as the user fred...
(You will need to make the directories beforehand...)

(the su dynamic executable...)
cp /usr/bin/su /chroot/usr/bin/su

(libs for su)
cp /usr/lib/libutil.so.3 /chroot/usr/lib/libutil.so.3
cp /usr/lib/libskey.so.2 /chroot/usr/lib/libskey.so.2
cp /usr/lib/libmd.so.2 /chroot/usr/lib/libmd.so.2
cp /usr/lib/libcrypt.so.2 /chroot/usr/lib/libcrypt.so.2
cp /usr/lib/libc.so.4 /chroot/usr/lib/libc.so.4

(ELF interpreter)
cp /usr/libexec/ld-elf.so.1 /chroot/usr/libexec/ld-elf.so.1

(bash, lets call it moo, my bash is static...)
cp /usr/local/bin/bash /chroot/bin/moo

(copy login details for fred, assuming you have a fred user, useradd if needs be or whatever...)
grep fred /etc/master.passwd > /chroot/etc/master.passwd

(will need root also for su...)
grep root /etc/master.passwd >> /chroot/etc/master.passwd

(create the passwd databases)
pwd_mkdb -p -d /chroot/etc /chroot/etc/master.passwd


Now you _should_ be able to run moo (aka bash) in
the chroot environment...

chroot /chroot su -lm fred -c "/bin/moo"
moo-2.04$ pwd
/
moo-2.04$ echo *
bin etc usr


mind you, all you will be able to do is 'cd' and 'echo *' but hey

Follow that and you should be able to get your ircd running in the chroot, good luck