As
regular readers of Unix Insider probably know, Peter Galvin has
abdicated as Unix Insider's security czar to start a new system
administration column for this magazine. Following Peter's lead, this column
will continue to provide practical, technical information about
computer security based on real-world experiences.

I'm currently working as an independent security consultant in the
New York financial market. This gives me the opportunity to design
and implement solutions in different environments in parallel. Because
every environment is unique, it's possible that something that
worked out great for me will be totally wrong for you. There's no
single solution or product that is optimal for all people at all times.
My goal is to provide the gory technical details of
problems encountered and solutions that have worked in most environments.

As has been discussed numerous times, most security problems are the
result of human negligence. If more programmers followed the advice
set forth in Peter's April 1998 column,
there wouldn't be as much to write about here. I've worked with
developers who refuse to even follow basic source code control
such as SCCS. Unfortunately, system administrators often have no
control over the development environment and are unable to impose
proper development procedures.

What the administrator can do is to consider the application suspect and
place it in a padded cell using chroot.

I cowrote with Peter the May and June 1998 Security
columns, which described
the installation of a Web server in a padded cell environment that
my partner, Jonathan Klein, and I installed at a client site.
I was rather surprised at all the feedback complaining that padded cells
are too difficult to set up correctly. While it's true that there's a
lot of technical detail involved in creating a padded cell,
and while it certainly isn't a procedure for novices, it is
worthwhile to learn since it's a proven procedure that has been used
for years. To help make the learning process easier, this column includes
scripts written by Jonathan to create a basic padded cell.

Creating a basic padded cell

A padded cell is a unique environment specifically tailored for an
application. As such, these scripts probably won't work for your
particular application -- you'll need to edit the sample list
files. We've used these to configure the Netscape server, Sendmail,
FTP, and list servers, and we edit the list files each time.

Sample padded cell scripts

The following shell scripts can be used (with modification) to create a basic padded cell:

• make_cell
  
• mkdir_cell
  
• mksymdir_cell
  
• mkdev_cell
  
• cpfile_cell
  
• mksymfile_cell
  

The shell scripts use the following ASCII input files:

• dirlist
  
• symdirlist
  
• devlist
  
• filelist
  
• symfilelist
  

There's also a C program to create the proper device permissions:

• mkperm.c
  

You can click on the links above to see the scripts; I'll also provide
quick explanations of them below.

make_cell

This is a top-level master script that calls and runs all the other
scripts.

mkdir_cell

This script creates the directory structure needed to simulate a
mini-Unix operating environment. It creates directories such as
/etc, /usr, /lib, /usr/lib, and so on. The script decides which
directories to create based on the input file, dirlist. The file
provided here is an example only and needs to be edited for your
particular application.

mksymdir_cell

This script makes all the

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine