5 ms·
Why use iptables instead of ufw? Also, last I heard chroot is not secure for sandboxing, so why bother with it at all? I'd use cgroups or even lxc containers (
by wereHamster 14y ago
Why use iptables instead of ufw?
Also, last I heard chroot is not secure for sandboxing, so why bother with it at all? I'd use cgroups or even lxc containers (those are pretty well supported in the latest ubuntu).
- StavrosK 14y agoAnd why a chroot instead of just a dedicated user? If they can get root, it's game over anyway, isn't it?
- maaku 14y agoI don't think chroot does what you think it does.
- StavrosK 14y agoWhat do you think it does?
- rjbond3rd 14y agoChanges the filesystem root to be inside a certain folder.
- StavrosK 14y agoYeah, so what's the point? If you have a separate user, you can't access other users' files anyway, unless you have root. You can access the system files, but there should be nothing of much interest in there anyway.
- gvb 14y agoYou should have only the minimum necessary commands and libraries in your chroot jail which minimizes the attack surface. For instance, I use chroot with rssh to only allow sFTP/scp/rsync and not allowing chroot users to get to a shell prompt. In my chroot /usr/bin, there are only two files (rssh, scp). In my chroot /lib there are only 16 files. Compare to: 1670 in /bin /usr/bin /sbin 50507 in /lib /usr/lib /usr/lib64
- munin 14y agoUnless some of those files are setuid root ... what does it matter? Your chroot jail is still going to have a very rich attack surface - the kernel.
- jiggy2011 14y agoI guess to prevent an application (e.g a web server running as a non root user) from easily reaching outside and running arbitrary shell commands or reading files. For example if you have something horrible like a PHP script that does: echo system($_POST['whatever']) you at least should try and prevent it from doing "ls" and "cat" to start exploring the filesystem.
- throwaway2048 14y agowhy not both? After chrooting use setuid()/setguid() for an individual user.
- StavrosK 14y agoBecause of the added complexity.
- perlgeek 14y agoYou're correct. chroot works on a per-process basis by adding a relative fs root into the process (or process table? dunno) memory. If you're root, you can change it back to /.
- justincormack 14y agoIt is probably better than nothing (hard to get root if everything in the chroot is running as a user, no suid files, few devices). Probably need a kernel exploit then to get out. A container is better though.