Firewall Handbuch für LINUX 2.0 und 2.2 - zurück

This might be important if you cannot live without your tree. Don't laugh
--if all of your colleagues' documentation lives there, then, well, you
can't live without it. Sometimes documentation really IS important.
Before you start you have to decide if this is a do-able task. If your
entire tree can live on one file system, then this may be for you. But if
links and cgi-Skripts reach out across filesystems and nodes and people's
home directories (in this 'automounted' or 'afs-ed' world), then this
probably isn't your cup of tea. You have to know your web tree really well
first. In particular, take a close look at your cgi-Skripts and all Skripts
and utilities called by your cgi-Skripts before you start.
We use the CERN http daemon, and our web site is served by an HP running
9.05 HP-UX and NIS (but it is not an NIS server). This information is
necessarily HP-specific, but it should generalize. It took me a couple of
afternoons of work to produce a working web tree.
So these are the steps I followed to chroot a LIVE web tree. It wasn't as
painful as I thought it would be, but it requires a bit of work if you want
to provide a high level of functionality.
In the following steps I have assumed:
the web tree owner is: www
living in group: webgroup
I have also assumed that the new web root is at: /wtree
Create a tree in a NEW web root and give it the appropriate ownership. If
only one account edits files in the web tree, then your are set. If multiple
user accounts update files, then presumably you could have a special group
for web updating, and have people 'newgrp' to this group. Thus:
chown -R www:webgroup /wtree
chmod -R 755 /wtree (or 775 if 'webgroup' needs write permission)
You might also choose to create some kind of a 'home' directory structure
(see http://hoohoo.ncsa.uiuc.edu/docs/tutorials/chroot.html)
**From this point you work as user 'www'
Create the skeleton tree in the new web root. You will probably need:
bin, etc, tmp, dev, lib
You have to decide whether you are going to put sharable libraries in your
web tree. I decided to NOT do this (though in the end I put one library
there). If I was to do this all over again, I probably wouldn't have opted
for only staticly-linked versions. At the time I was worried about
'duplicating' my file system in the web tree.
If you decide to put sharable libraries in the tree, then you have to figure
out which ones. This might not be easy! Anyway, you should copy a useful set
of utilities to your /wtree/bin directory, and copy any necessary libraries
to /wtree/lib or /wtree/usr/lib.
Note: the 'useful set of utilities' is necessary if you use cgi Skripts in
your web tree. Therefore which ones you need will depend on which utilities
are referenced by your cgi-Skripts.
If you do as I did and opt for staticly-linked versions, then the easiest
thing is to get a bunch of GNU file utilities and compile them staticly, so
that you don't need shared libraries. These utilities are available in these
GNU files sets:
(bash, binutils, diffutils, find, gawk, grep, sed, textutils)
Only install what you will use; for example, don't install 'df' unless you
want to try to provide it with the 'mount table'. This is an example set of
Erstellt von Doc Gonzo - http://kickme.to/plugins