Printable View
Hi
I have to create a shell account on RedHat 9 for a guy that will compile amule on my machine. I just want him not able to wonder around on my machine.
I read this tutorial (http://www.antionline.com/showthread...hreadid=250875) but having compilation rights could get "free out of jail" (see h**p://www.bpfh.net/simes/computing/chroot-break.html)
So now I am stuck and no more ideas... Can you help?
Thanks
Instead of going to all that trouble, why dont you just use Red Hat Package Manager and install it.
http://dag.wieers.com/packages/amule/
something similar to what Net2Infinity said.
if you think the guy will try to hack your system or something, why dont you compile amule yourself for him. when you dont trust a person and think he could break out of a chrooted jail, hell....dont give him an account.
I completely agree!Quote:
Originally posted here by webDEViL
something similar to what Net2Infinity said.
if you think the guy will try to hack your system or something, why dont you compile amule yourself for him. when you dont trust a person and think he could break out of a chrooted jail, hell....dont give him an account.
Do I have to understand that NOBODY has a solution for a secure shell acount?
Please stick to my question. Avoiding it and giving alternative solutions doesn't help me. Let's take the bull by the horns...
You trust him right? Just give him a normal account,
and change the password when he's finished.
What's he gonna do, elevate his priveliges, get root,
install a rootkit and brag about it on irc?
If he does something harmful, you format and reinstall.
It's a rare individual that can escape the restrictions
of a normal account, much less a chroot jail.
:cool:
Quote:
Originally posted here by masster
Do I have to understand that NOBODY has a solution for a secure shell acount?
Please stick to my question. Avoiding it and giving alternative solutions doesn't help me. Let's take the bull by the horns...
If you give someone an account on your box, even in a chroot jail there are no guarantees. That being said if he installs the app in the chroot jail, what good is it going to do you? You specifically asked about installing a particular software so doing it yourself seemed like a good option. Obviously you want to give the individual an account for different purposes.
Please enlighten me (in detail, command by command) HOW is he gonna deploy such catastrophic scenario.Quote:
Originally posted by rcgreen
What's he gonna do, elevate his priveliges, get root, install a rootkit and brag about it on irc?
OK then, starting from here, are there ANY OTHER solutions for my problem?Quote:
Originally posted by Net2Infinity
If you give someone an account on your box, even in a chroot jail there are no guarantees.
He doesn't install ANYTHING. He just compiles latest amule version to RPM binaries for RH9. So that I install them and have amule working on my machine.Quote:
Originally posted by Net2Infinity
That being said if he installs the app in the chroot jail, what good is it going to do you?
Not when you get into some undocumented compilation errors that even amule forum couldn't solve...Quote:
Originally posted by Net2Infinity
You specifically asked about installing a particular software so doing it yourself seemed like a good option.
Dude, you must be God if you know better than me what I'm thinking... I suggest you don't jump so easy to conclusions.Quote:
Originally posted by Net2Infinity
Obviously you want to give the individual an account for different purposes.
Okay if you wanted to install amule I sent you the link for the amule as an rpm package. It doesnt get any easier than that as it is already precomplied for red hat 9. Why would you want to go to the trouble of chrooting an account for a friend to complile it for you when it is already an rpm?
The answer is simple.................go write your own Linux distro, then you can incorporate whatever security measures you like :cool:Quote:
Do I have to understand that NOBODY has a solution for a secure shell acount?
If they work, they should. I absolutely despise people coming to me with problems and then having the arrogance to tell me how to solve them. If they are that bloody clever, why don't they go figure it for themselves? :rolleyes:Quote:
Please stick to my question. Avoiding it and giving alternative solutions doesn't help me.
I think that we just have? ..................... additionally, do you think that is a good idea to let someone you apparently don't trust, do development work on what is obviously your live production system? ..................... how can you be sure exactly what they put on there?Quote:
Let's take the bull by the horns
In the real World we develop in a test/development environment then migrate the final result to the live, production one. If you do not have that luxury, then move anything sensitive off the machine and reinstall it afterwards.
You should also consider basic human psychology............. if you create an atmosphere of mistrust you will simply be challenging the person to outwit you, and may well create a situation that would otherwise not have arisen.
The exploit that you mentioned,
only talks about escaping from chroot, not elevating privelige,
I am not a programmer, and probably couldn't pull this off,
so I wouldn't be afraid of letting my friend compile something
as a normal user. Setting up the chroot jail with a compiler
isn't a trivial task either. Since I am not an admin at a nuclear
weapons lab, I don't have to worry about it. If you don't trust the guy,
there's no easy way to give him access without taking some small
risk.
I installed and used for about a month those RPMs (version 2.0) that you are talking about till I got sick and tired of the many bugs that it had. Last version is 2.1.3 and has MANY improvments. I really hope that you have all data now.Quote:
Originally posted by Net2Infinity
Okay if you wanted to install amule I sent you the link for the amule as an rpm package.
@ rcgreen
I see that you dropped your story about elevating privileges and admitted you don't have any clue about HOW doing it. I heard so many stories about 13 yo kids breaking CIA computers that one more from you doesn't even bother me...
I have no idea what are you talking about. But if you imply that he could stole my porn collection :D :D ... ok... I'm scared.Quote:
Originally posted by nihil
You should also consider basic human psychology............. if you create an atmosphere of mistrust you will simply be challenging the person to outwit you, and may well create a situation that would otherwise not have arisen.
Absolutely not!.............. everyone here will tell you that my collection is far superior to yours....... I would have just asked for a contact number for him so we could have come to a "private arrangement" :pQuote:
I have no idea what are you talking about. But if you imply that he could stole my porn collection
My concern was a genuine observation of the rule that if you treat people like little schoolboys, you must expect them to behave as such?
Now, is there any reason why this guy actually needs to use your system for this development? I ask this because I have seen too many disasters when people have tried to develop on production equipment!!!
Could he develop offline and bring you a CD/DVD ?
;)
Flash news: he compiled amule 2.1.3 and did a GREAT job. Now amule forum has a new section for existing distro packages: RedHat 9.Quote:
Originally posted by nihil Now, is there any reason why this guy actually needs to use your system for this development? I ask this because I have seen too many disasters when people have tried to develop on production equipment!!!
But my question stays valid and unanswered: is there ANY OTHER solution for having a user "jailed" in his own yard but still having compilation rights?
If not, just say it so we can all close this topic and go to bed to our (neglected) girlfriends.
Never had a story.Quote:
you dropped your story about elevating privileges
It wasn't myself I was referring to, and I was suggestingQuote:
What's he gonna do, elevate his priveliges, get root,
install a rootkit and brag about it on irc?
that your paranoia wasn't justified, since there is really
not much harm he can do. It's only a computer.
:cool:
The solution as far as I can see, is to install FreeBSD 4.x or above since that has a more secure chroot() call than Linux does. It's mentioned in the very internet article that you linked to. Otherwise, the Linux chroot() call is less than secure and exploitable IF a privelege escalation vulnerability also exists on your system.
Remember, if the way a program is written makes it inherently vulnerable, there's not much you can do about it except write your own program that mimics the same functionality. You could theoretically write an alternative chroot program that doesn't use the chroot() system call. But any suggestions on how exactly to do this are far beyond my scope of knowledge.
Cheers,
cgkanchi
In a single word...............................Quote:
But my question stays valid and unanswered: is there ANY OTHER solution for having a user "jailed" in his own yard but still having compilation rights?
NO!
Why should there be? as I have mentioned, you do untrusted work in an untrusted (development) environment. That should be a fundamental part of your security model.
Please remember that physical security is of paramount importance yet is so frequently overlooked.
My view (and that of most military and security agencies) is that if you allow someone physical access or remote access with rights of a level such as compilation, you really do have to trust them ;)
allrighty then... so this pretty much wraps it. thank you for advice and patience.
I go now throw my Linux machine in a safe having only a tiny hole for network cable.
And guess what? I hired a genie with a mighty sword that guards it and chops heads (or packet HEADers ?) off if any hacker tries to get in.
Cheers :cool:
Lol .. I first replyed to the PM and only now discovered the thread.. here's the main part of the PM I wrote masster just now..
Quote:
With compiling (or theoretically downloading) rights you can have people breaking out of the jail..
If you don't keep up-to date on your installed software compiling 'rights' might even let people gain root..
That said you should look at what packages you want to use and include those libraries..
So that would be gcc. the autotools and bintools etc..
Take a look inside the packages you would normally install for those functions.
I must add that the tutorial is a bit outdated..
But it does work.. I have a public secret shell acount myself for 'friends'
Just curious: If you don't trust them to be on the box or install software... then WHY would you let them compile source into a binary that you're going to run with your own privledges. You could be the one elevating the privledges for them. IF they modify the source code to include the backdoor or rootkit, and you install it, then you just made their job *that* much easier.
Why can't you just compile it yourself?
What about using vmware? Install your distro. Do you best to "jail" them. Firewall that machine off from the rest of your hosts. Give them access and let them compile. When they're done, copy off their binary and then dump the virtual machine. Now, you have your binary and they were never actually on your box. Just a virtual box run on your box.Quote:
Originally posted here by masster
Flash news: he compiled amule 2.1.3 and did a GREAT job. Now amule forum has a new section for existing distro packages: RedHat 9.
But my question stays valid and unanswered: is there ANY OTHER solution for having a user "jailed" in his own yard but still having compilation rights?
If not, just say it so we can all close this topic and go to bed to our (neglected) girlfriends.
Not only that. But, if you wanted to keep the session. You could always take a snapshot of it before you give them access, let them do their thing, copy off their work and then roll back to the state before they had access.
But, that still doesn't mean that you're going to have a clean binary. They could still have "patched" the code with a backdoor or rootkit or whatever. Best option is to download the source yourself and build it yourself. Unless you have multiple personalitites and don't trust yourself.
We don't :D :p :eek:Quote:
Unless you have multiple personalitites and don't trust yourself.
I answered to those questions, if only you read ALL topic.
And as I said, I'm happy now, not to mention that the_JinX offered a solution instead asking a ton of supplementary questions.
Just to stir things even more... If that person is able to ssh into your machine but didn't have access to a compiler what's there to stop him from uploading and executing a pre-compiled binary that would break out of the chroot/jail/whatever? Having access to a compiler or not is moot. S/He has access to your machine..