September 28, 2001, 3:14 PM — As
regular readers of Unix Insider probably know, Peter Galvin has
abdicated as Unix Insider's security czar to start a new system
administration column for this magazine. Following Peter's lead, this column
will continue to provide practical, technical information about
computer security based on real-world experiences.
I'm currently working as an independent security consultant in the
New York financial market. This gives me the opportunity to design
and implement solutions in different environments in parallel. Because
every environment is unique, it's possible that something that
worked out great for me will be totally wrong for you. There's no
single solution or product that is optimal for all people at all times.
My goal is to provide the gory technical details of
problems encountered and solutions that have worked in most environments.
As has been discussed numerous times, most security problems are the
result of human negligence. If more programmers followed the advice
set forth in Peter's April 1998 column,
there wouldn't be as much to write about here. I've worked with
developers who refuse to even follow basic source code control
such as SCCS. Unfortunately, system administrators often have no
control over the development environment and are unable to impose
proper development procedures.
What the administrator can do is to consider the application suspect and
place it in a padded cell using chroot.
I cowrote with Peter the May and June 1998 Security
columns, which described
the installation of a Web server in a padded cell environment that
my partner, Jonathan Klein, and I installed at a client site.
I was rather surprised at all the feedback complaining that padded cells
are too difficult to set up correctly. While it's true that there's a
lot of technical detail involved in creating a padded cell,
and while it certainly isn't a procedure for novices, it is
worthwhile to learn since it's a proven procedure that has been used
for years. To help make the learning process easier, this column includes
scripts written by Jonathan to create a basic padded cell.
Creating a basic padded cell
A padded cell is a unique environment specifically tailored for an
application. As such, these scripts probably won't work for your
particular application -- you'll need to edit the sample list
files. We've used these to configure the Netscape server, Sendmail,
FTP, and list servers, and we edit the list files each time.
The following shell scripts can be used (with modification) to create a basic padded cell:
The shell scripts use the following ASCII input files:
There's also a C program to create the proper device permissions:
You can click on the links above to see the scripts; I'll also provide
quick explanations of them below.
make_cell
This is a top-level master script that calls and runs all the other
scripts.
mkdir_cell
This script creates the directory structure needed to simulate a
mini-Unix operating environment. It creates directories such as
/etc, /usr, /lib, /usr/lib, and so on. The script decides which
directories to create based on the input file, dirlist. The file
provided here is an example only and needs to be edited for your
particular application.
mksymdir_cell
This script makes all the required symbolic links for directories.
For example, it will create the symbolic link from $root/bin to
$root/usr/bin. The input file for this script is symdirlist.
mkdev_cell
This script creates the devices in the cell directory that will be
required by the application. It also creates the symbolic links as
required. The input file for this script is devlist. Be very careful
to edit this file and include only the devices you will need.
Remember, the devices listed are only a guide. This script also uses
a C program, mkperm.c, to set the correct permissions for the
devices.
cpfile_cell
This script copies into the cell the system files you will need to run
the application. The input file is filelist.
