Gentoo Archives: gentoo-security

From: Nathanael Hoyle <nhoyle@××××××××××××.net>
To: gentoo-security@l.g.o
Subject: Re: [gentoo-security] Advice about security solution
Date: Wed, 09 Nov 2005 22:17:18
In Reply to: Re: [gentoo-security] Advice about security solution by Anders Bruun Olsen
Anders Bruun Olsen wrote:
> On Wed, Nov 09, 2005 at 02:26:28PM -0600, Nathanael Hoyle wrote: > >>>I use the default Gentoo accounts for daemons - fairly certain none of >>>them use "nobody". I may be wrong? >> >>Can't answer that question for all gentoo ebuilds. There are probably >>some that do. I haven't run all of the daemons that you are running, >>but rather than assume, check them out individually. As one example, I >>was dismayed to realize when I emerged pdns that by default it just runs >>root. I manually added a user and group for pdns and modified the >>config to run as those users after binding the port initially (since >>port 53 is priviledged). I'd verify user id's for each daemon. > > > That's probably a very good idea. > > >>>>3) Chroot jail daemon processes wherever possible. >>> >>>Hmm.. any good guides or pointers to get Apache, MySQL, Postfix, >>>Courier-imap, rsyncd, ventrilo, cs-server, zope and so on to run in >>>jails? >> >>As another poster has mentioned, mod_chroot for apache is worth looking >>into. rsyncd on gentoo comes with options to chroot in the conf.d as I >>recall. Postfix is quite happy to chroot after setting a config option >>as long as the jail is set up properly. The docs on go into >>this setup pretty carefully. > > > Now that you mention it, I seem to recall actually having run rsyncd in > a chroot earlier. And for Postfix I'm gonna go run off to > asap - or maybe that Postfix book I bought earlier this year has > something about that subject. It's the one by Patrick Koetter and Ralf > Hildebrandt and I seem to recall that they are very security concious. > >
That would be "The Book of Postfix". I'm an active participant in the Postfix users' list, and I've corresponded with Patrick and Ralf several times, they know their stuff and I've heard very good things about the book, planning to pick up a copy one of these days. I'd expect the coverage of security aspects to be quite good.
>>>That's a very good idea, only they still need to be able to start their >>>programs as they are used to. I can't seem to find jail-shell anywhere. >>>Is it just a concept for configuring i.e. Bash or is it actually >>>available somewhere? >> >>Googling "jail shell" turns up several different shells designed for this. > > > Of course, I should have tried thinking a little there - I'll go google > it :) > > >>Good luck, > > > Thank you. >
-- Nathanael Hoyle Systems and Networking Speed Express Networks, LLC nhoyle@××××××××××××.net 432.837.2811 -- gentoo-security@g.o mailing list