Firewall Handbuch für LINUX 2.0 und 2.2 - zurück

Where directory is the new root directory and command is the command to run
under that directory.
For example:
chroot /www httpd
In this example, /www will become the new / directory, and anything not
under /www will not be accessible.
There are some difficulties associated with this, however. Anything you want
to server/run/etc. needs to be in /www. This also means that if HTTPd is
linked with shared libraries, the shared libraries have to be available
under /www. Any cgi Skripts must be under /www, as well as the interpreters
(sh,perl,etc) needed to run them. Any shared libraries for the cgi Skripts
need to be in /www. The document tree, the server root, the logfiles, the
user directories (and a copy of /etc/passwd in /www/etc/passwd if you want
to have /~username/ paths). You don't want to have the passwords in the
/www/etc/passwd file, and you could fake a different user directory in it
for /~username/ paths that is under the /www directory.
Denice Deatrich of CERN set his server up in a chroot environment. He wrote
a step by step guide available here
--------------------------------------------------------------------------------
This is a non-trivial thing to setup, and it is unlikely to be necessary.
We will provide only minimal support for setting up a chroot server, as we
don't use this locally.
--------------------------------------------------------------------------------
Example
Using the following directory tree:
/www
/www/etc
/www/docs
/www/logs
/www/conf
/www/home
/www/home/blong
/www/home/httpd
/www/cgi-bin
/www/icons
/www/lib
/www/bin
Where /www will be the new root directory.
Into /www/lib you will need to copy at least the shared c library (libc.so,
libc.sa, libc.a, libc.sl, or ..., depending on the system). Other libraries
may be necessary depending on the system and what other binaries you want to
run.
In /www/bin, you will need copies of sh, perl, tclsh, etc. If you have any
gateways such as archie, uptime, date, finger, ph, copies of these programs
will also have to be in in /www/bin.
/www/docs is your document root, but in the srm.conf file, it will be set to
/docs (which is the directory after the chroot command).
/www/etc might need a copy of /etc/passwd and /etc/group. Make sure there
Erstellt von Doc Gonzo - http://kickme.to/plugins