Re: Multi-User Security

From: Gregory Sutter (gsutter_at_zer0.org)
Date: 05/18/04

  • Next message: Dan Rue: "Re: Multi-User Security" 
    Date: Tue, 18 May 2004 01:35:27 -0700
To: Norberto Meijome <freebsd@meijome.net>

    On 2004-05-18 14:41 +1000, Norberto Meijome <freebsd@meijome.net> wrote:
    > Richard Coleman wrote:
    >
    > >Using a chroot or a jail is the way to go if possible. If you can't use
    > >that, then unix permissions or ACL's is the next bet. Restricting
    > >commands is the most fragile solution since in many cases it can be
    > >subverted.
    >
    > Excuse my ignorance, could you quickly tell me the difference (or point
    > me to a good reference article/book) between chroot + jail?
    > is it that a jail is always chrooted but not the other way around?
    > is a jail more encompassing than chroot only?

    If you had typed "freebsd jail" into Google, this paper would have
    been the first of several hundred useful links. The answer to your
    question is in its introduction.

      http://docs.freebsd.org/44doc/papers/jail/jail.html

    Greg 

    -- 
Gregory S. Sutter                    Was Jimi's modem a Purple Hayes?
mailto:gsutter@zer0.org 
http://zer0.org/~gsutter/

  • Next message: Dan Rue: "Re: Multi-User Security"

    Relevant Pages

    • Re: FTP guest access chroot not working
      ... the "root" dir for the chroot is /home/someguy/ftp ... # chroot ftp users ... cannot get out of that jail. ... if you created a symlink inside the jail that points to some real ...
      (comp.unix.sco.misc)
    • Re: /devices jailbreak
      ... however as duplicating device special files does /not/ ... processes in a chroot env will ... duplicates in the chrootjail ultimately lead to the same actual ... But that path will be in the chrootjail, as far as the jailed process ...
      (comp.unix.solaris)
    • Re: /devices jailbreak
      ... processes in a chroot env will ... outside the chroot environment will of course report the device paths ... within the jail as a normal user with the restricted Korn ... directory tree, as expected, except for a couple /devices files ...
      (comp.unix.solaris)
    • Re: /devices jailbreak
      ... however as duplicating device special files does /not/ ... processes in a chroot env will ... duplicates in the chrootjail ultimately lead to the same actual ... But that path will be in the chrootjail, as far as the jailed process ...
      (comp.unix.solaris)
    • Re: exiting chroot()
      ... I understand the need and desire for the chroot jail, ... >> If security is so slack as to let someone login as root to run something ...
      (comp.unix.programmer)