Version 0.1, last update 2003/12/9

Introduction

This section wants to provide a practical example on system hardening. As the base operating system I am using gentoo Linux. But it should be easy to port this example, although with little changes, to other Linux distributions. Here I want to show how to run the (http/https) proxyserver tinyproxy in a jail/chroot environment. Running a service in such an environment results in a great security enhancement, because if someone was able to use the running service to break into the system, then he can only act in an environment, where his possiblities are extremely limited. Additionally one should run the service as an user with very limited rights and prohibit double-chrooting via kernel patches (such a the one provided by grsecurity.net).

Dependencies

The problem with running services inside jail/chroot environments is to fulfil all dependencies the service needs to run. So the main task is to provide a list of files, needed by the service tinyproxy to function properly. In table 1 I will show the files, that have been copied into the directory /var/chroot/tinyproxy.

The file etc/group holds only the group nogroup and the file etc/passwd holds only the user tinyproxy with home directory /var/empty and shell /dev/null. After that we have to change the ownership of /var/chroot/tinyproxy to tinyproxy and nogroup. This can be done by executing:

chown -R tinyproxy:nogroup /var/chroot/tinyproxy

The Runscript

In oder to start tinyproxy at system startup, we have to make some changes to the runscript /etc/init.d/tinyproxy. Table 2 show the whole runskript for running tinyproxy in a jail/chroot environment.

Last but not least we have to assign the runscript to a runlevel, i.e.:

rc-update add tinyproxy default

and execute it:

/etc/init.d/tinyproxy start

Finished. On other systems, some steps might be different. But the main hurdle is always the dependencies.

back to top