What is Digg?Sponsored by Travelzoo
Take Advantage of Ridiculously Low Holiday Airfares view!
travelzoo.com - Flights $52 and up for Thanksgiving, Christmas & New Year. But move on it now.
10 Comments
- LoDown, on 10/12/2007, -0/+1Another option is to use a Linux app known as "Jail". Homepage is: http://www.jmcresearch.com/projects/jail/
Just something for you to check out. - sheetrock, on 10/12/2007, -0/+1Here's some good companion reading: http://www.bpfh.net/simes/computing/chroot-break.html
SSH+Chroot wouldn't be enough of a partition for me to feel comfortable with untrusted users on my system. It might be better used in conjunction with setting up a separate machine or at least a UML environment as the SSH server -- where breaking a firewall or the virtualization adds another layer of difficulty to an attacker. - krux, on 10/12/2007, -0/+1using the scponly shell with ssh is a lot easier.
- Whatchamacallit, on 10/12/2007, -0/+1chroot and jail are well proven and trusted ways to isolate users on a shared host. i.e. big ISP's and webhosts use this all the time. ISP's for their ftp and webhosts are doing the ssh chroot thing if they offer shell access. It works perfectly...
/home/user1
/home/user2/ - anotherbob, on 10/12/2007, -0/+0Root jails don't create a false sense of security. Bonehead admins create a false sense of security.
When it comes down to it, the best security tool is a security policy. And root jails can be a valuable element of that policy. But mocking or glorifying jails, IDS's, crypto algorithms, etc. misses the point.
+dugg - firestorm, on 10/12/2007, -0/+0Or Rsh (restricted shell)
- veracon, on 10/12/2007, -0/+0My host (Site5) uses jail for SSH access, though you can request to be unjailed if you have a good reason (like when I wanted to install PHP5).
- sakibomb, on 10/12/2007, -0/+0this is a debian specific howto. hausmasta should have said as much in his description.
- fac3less, on 10/12/2007, -0/+0The problem is even this creates a false sense of security on a webserver.
In most cases apache (or the httpd) runs as 'nobody' (with most of-used panels) and thus anyone with php can just 'cat' any file they want and grab the information they need. Database details/logins, etc. ;) - SuperSloth, on 10/12/2007, -1/+0In other news, Linux security is only as good as the idiot managing the box.
© Digg Inc. 2009
— Content created and posted by Digg users is