Ê×Ò³  |  Õ¾µãµØͼ  |  Ë÷Òý  |  ËÑË÷

by Mark Nielsen (homepage) ¹ØÓÚ×÷Õß: Mark ÏÈÉúÊÇһ뽫×Ô¼ºµÄʱ¼ä¶¼¾èÏ׸ø GNUJob.com µÈÊÂÒµµÄ×ÔÓÉ×ÉѯÕߣ¬ËûдÁ˺ܶàµÄÎÄÕºÍ×ÔÓÉÈí¼þ£¬ ²¢ÇÒÊÇeastmont.netµÄÒ»ÃûÖ¾Ô¸Õß¡£ Ŀ¼: ½éÉÜ ÔõÑù°ÑËùÓеķþÎñ¶¼chrootÄØ£¿ ÎÒÓÃÀ´´´½¨chroot»·¾³µÄPerl½Å±¾¡£ ¶Ô Ntpd ½øÐÐ Chroot ¶Ô DNS ºÍ named ½øÐÐ Chroot °Ñ Syslog ºÍÆäËû·þÎñÒ»Æð½øÐÐchrootÒÔ¼°ÎÒËùÓöµ½µÄÀ§ÄÑ¡£ ¶Ô Apache ½øÐÐ Chroot ¶Ô Ssh ½øÐÐ Chroot °Ñ PostSQL ½øÐÐ Chroot °Ñ Sendmail ½øÐÐ Chroot ¹ØÓÚ Chroot µÄÆäËûһЩÊÂÇé¡£ ½¨Òé ½áÂÛ ²Î¿¼ÊéÄ¿ ¶ÔÕâƪÎÄÕ·¢±íÆÀÂÛ

Chroot LinuxÖÐËùÓеķþÎñ

ÕªÒª:

¶Ôϵͳ·þÎñ½øÐÐchrootÒÔÏÞÖÆÈëÇÖÕß¿ÉÄÜÔì³ÉµÄÆÆ»µ£¬´Ó¶øÌá¸ßϵͳµÄ°²È«ÐÔ¡£

½éÉÜ

ÄÇÕâÑùÓÖÓÐʲôÓÃÄØ£¿Èç¹ûÈëÇÖÕßÈëÇÖÁËÄãµÄµçÄÔ£¬ËûÃǾͲ»ÄÜ¿´¼ûÄãϵͳÀïËùÓеÄÎļþÁË¡£ ÕâÑù£¬¾ÍÏÞÖÆÁËÈëÇÖÕß¿ÉÄÜÖ´ÐеÄÃüÁ´Ó¶ø½ûÖ¹ÁËËûÃÇÒç³ö²»°²È«ÎļþµÄ»ú»á¡£µ«Î¨Ò»µÄȱµãÊÇ£¬ ÎÒÈÏΪÕâ²»ÄÜ×èÖ¹ËûÃDz쿴ÍøÂçÁ¬½ÓºÍÆäËû×ÊÁÏ¡£Òò´Ë£¬ÄãÓ¦×öһЩ±¾ÎÄδÉîÈëÉæ¼°µÄÊÂÇ飺

• ±£»¤ÍøÂç¶Ë¿Ú¡£
• ²ì¿´ÊÇ·ñËùÓеķþÎñ¶¼ÒÔ·ÇrootȨÏÞÔËÐС£ÁíÍ⣬ÊÇ·ñËùÓеķþÎñ¶¼½øÐÐÁËchroot£¿
• °ÑϵͳÈÕ־תÒƵ½ÆäËûµçÄÔ¡£
• ·ÖÎöÈÕÖ¾Îļþ¡£
• ·ÖÎöÄÇЩÊÔͼ̽²âÄãµÄ¼ÆËã»úµÄËæ»ú¶Ë¿ÚµÄÈËÃÇ¡£
• ÏÞÖÆ·þÎñËùÕ¼ÓõÄcpuºÍÄÚ´æ×ÊÔ´¡£
• ¼¤»îÓû§Åä¶î¡£

Çë¼Çס ÎÒËù×öµÄ²¢²»ÊÇ100%ÕýÈ·µÄ¡£ÕâÊÇÎÒµÚÒ»´Î³¢ÊÔÕâÑù×ö£¬¾ÍËãÖ»ÊDz¿·ÖÓÐЧµÄ»°£¬ Ò²Ó¦¸ÃÊǺÜÈÝÒ×Íê³É»ù±¾µÄÅäÖõġ£ÎÒÏë×öÒ»¸öchrootµÄHOWTO£¬ÏÖÔÚËù˵µÄÖ»ÊÇһЩ»ù±¾µÄ¶«Î÷¡£  

ÔõÑù°ÑËùÓеķþÎñ¶¼chrootÄØ£¿

• Syslogd ·Ö±ðºÍÿһ¸ö·þÎñÒ»ÆðÔËÐÐÔÚhroot»·¾³Ï¡£
• Apache ÔËÐÐÔÚ/chroot/httpdÏÂ.
• Ssh ÔËÐÐÔÚ/chroot/sshdÏÂ.
• PostgreSQL ÔËÐÐÔÚ/chroot/postmasterÏÂ.
• Sendmail ÔËÐÐÔÚ chroot»·¾³Ï£¬µ«²»ÐÒµÄÊÇ£¬Ëü±ØÐëÒÔrootȨÏÞÔËÐС£
• ntpd ÔËÐÐÔÚ /chroot/ntpdÏ¡£
• named ÔËÐÐÔÚ /chroot/named Ï¡£

ÎÒÓÃÀ´´´½¨chroot»·¾³µÄPerl½Å±¾¡£

1. ´´½¨chrootĿ¼
   mkdir -p /chroot/Config/Backup
2. ÏÂÔØConfig_Chroot.pl.txt ²¢¸üÃûΪ /chroot/Config_Chroot.pl
3. Èç¹ûÄãµÄ¼ÒĿ¼£¨home directory£©²»ÊÇ/chroot£¬Çë°ÑPerl½Å±¾ÀïµÄ$Home ±äÁ¿×÷ÏàÓ¦µÄ¸Ä±ä¡£
4. ÏÂÔØÎÒµÄÅäÖÃÎļþ¡£

ÇëÔÚPerl½Å±¾Àï×÷ÏàÓ¦µÄ¸Ä±äÒÔÊÊÓ¦ÄãµÄ·¢Ðа档

¹ØÓÚchroot£¬ÎÒдÁËÒ»±éºÜ³¤µÄÎÄÕ£¬µ«ÓÐÁËÎҵĽű¾£¬Ëü±äµÃ¶ÌÁ˺ܶࡣÔÚchrootÁ˺ܶà·þÎñÖ®ºó£¬ÎÒ×¢Òâµ½ÕâЩ·þÎñÖÐÐèÒª±»chrootµÄÎļþºÍÅäÖö¼ºÜÏàËÆ¡£¶ÔÒ»¸öÌض¨µÄ·þÎñÀ´Ëµ£¬ÅжÏÄÄЩÎļþÐèÒª¿½±´µÄ×îÈÝÒ׵ķ½·¨ÊDz鿴man£¬Èç¹û³ÌÐòÒªÓõ½¿âÎļþ£¬¾ÍÔÙ¼üÈë¡°ldd /usr/bin/file¡°¡£Ä㻹¿ÉÒÔ°ÑÄãÕýÔÚ°²×°µÄ·þÎñ½øÐÐchroot²¢ÊÖ¶¯Æô¶¯£¬ ¿´¿´³öÁËʲô´í»ò²éÒ»²éËüµÄÈÕÖ¾Îļþ¡£

ͨ³££¬Òª°²×°Ò»¸ö·þÎñ£¬¿ÉÒÔÕâÑù×ö£º

cd /chroot
./Config_Chroot.pl config  SERVICE
./Config_Chroot.pl install SERVICE
./Config_Chroot.pl start   SERVICE

¶Ô Ntpd ½øÐÐ Chroot

cd /chroot
 # Èç¹ûÄãûÓÐʹÓÃÎÒµÄÅäÖÃÎļþ£¬Çë°ÑÏÂÒ»ÐеÄ×¢ÊÍÈ¥µô¡£
#./Config_Chroot.pl config  ntpd
./Config_Chroot.pl install ntpd
./Config_Chroot.pl start   ntpd

¶Ô DNS ºÍ named ½øÐÐ Chroot

Èç¹ûÄãÏëÓÃÎҵĽű¾

cd /chroot
 # Èç¹ûÄãûÓÐʹÓÃÎÒµÄÅäÖÃÎļþ£¬Çë°ÑÏÂÒ»ÐеÄ×¢ÊÍÈ¥µô¡£
#./Config_Chroot.pl config  named
./Config_Chroot.pl install named
./Config_Chroot.pl start   named

°Ñ Syslog ºÍÆäËû·þÎñÒ»Æð½øÐÐchrootÒÔ¼°ÎÒËùÓöµ½µÄÀ§ÄÑ¡£

• °Ñsyslogd·Ö±ðºÍÿһ¸ö·þÎñ½øÐÐchroot¡£ÎÒʵ¼ÊÉϾÍÊÇÕâÑù²âÊԵģ¬¶øÇҼǼÁËһЩÈÕÖ¾¡£ÎÒ²»Ï²»¶ÕâÑù×ö£¬ÒòΪÎÒÓÐÒ»¸öÒÔrootȨÏÞÔËÐеķþÎñ¡£
• ¿´¿´ÎÒÃÇÊÇ·ñÄÜÁ¬½Óµ½ÍⲿÈÕÖ¾¼Ç¼É豸¡£
• Ö±½Ó°ÑÈÕÖ¾¼Ç¼µ½ÎļþÉ϶ø²»ÊÇͨ¹ýsyslogd¡£Õâ¿ÉÄÜÊÇ×îºÃµÄ°²È«Ñ¡ÔñÁË£¬¾¡¹ÜÈç¹û±»ÈëÇÖ£¬ÈëÇÖÕß¿ÉÒÔËæÒâ¸Ä¶¯ÈÕÖ¾¡£
• ÅäÖÃsyslogdÀ´²é¿´¼¸¸öµØ·½£¬´Ó¶øµÃµ½ËùÓеķþÎñ£¬Äã¿ÉÒÔÓÃsyslogdµÄ-aÑ¡ÏîÀ´×öµ½¡£

Èç¹ûÄã²»ÏëΪÿһ¸ö·þÎñ¶¼Å䱸һ¸ö¶ÀÁ¢µÄsyslogd£¬ÄÇôµ±ÄãµÄϵͳÔËÐÐsyslogdʱ£¬ÇëÔÚsyslogd¿ªÊ¼Ê±ÔËÐÐÏÂÃæÃüÁ

syslogd -a /chroot/SERVICE/dev/log

syslogd -a /chroot/ssh/dev/log -a /chroot/named/dev/log -a /dev/log

¹ØÓÚsyslogd£¬ÎÒ×îºóÏë˵µÄÊÇ£¬ÎÒÏ£ÍûËüÄÜÔËÐÐÔÚ·ÇrootÕË»§Ï¡£ÎÒÊÔÁ˼¸¸ö¼òµ¥µÄ¶«Î÷£¬ µ«¶¼Ã»Óгɹ¦£¬ÓÚÊǾͷÅÆúÁË¡£Èç¹ûÄÜÈÃsyslogdºÍÿһ¸ö·þÎñÒ»ÆðÔËÐÐÔÚ·ÇrootÕË»§Ï£¬ ÎҾͻá¶ÔÎҵݲȫ´ëÊ©¸Ðµ½ÂúÒâÁË¡£Èç¹û¿ÉÄܵĻ°£¬×îºÃ½«ÈÕÖ¾¼Ç¼µ½ÍⲿÉ豸ÉÏ¡£  

¶Ô Apache ½øÐÐ Chroot

$dbh ||= DBI->connect('dbi:Pg:dbname=DATABASE',"","", {PrintError=>0});

if ($dbh ) {$dbh->{PrintError} = 1;}
else
  {$dbh ||= DBI->connect('dbi:Pg:dbname=DATABASE;host=127.0.0.1',"","",
      {PrintError=>1});}

Ô´µØÖ·: http://httpd.apache.org/dist/httpd/

°Ñapache±àÒë²¢°²×°ÔÚÄãϵͳµÄ/usr/local/apacheĿ¼Ï£¬È»ºóÔËÐÐPerl½Å±¾¡£

cd /chroot
 # Èç¹ûÄãûÓÐʹÓÃÎÒµÄÅäÖÃÎļþ£¬Çë°ÑÏÂÒ»ÐеÄ×¢ÊÍÈ¥µô¡£
 # ./Config_Chroot.pl config  httpd
./Config_Chroot.pl install httpd
./Config_Chroot.pl start   httpd

ExtendedStatus On

<Location /server-status>
    SetHandler server-status
    Order deny,allow
    Deny from all
    Allow from 127.0.0.1
</Location>

<Location /server-info>
    SetHandler server-info
    Order deny,allow
    Deny from all
    Allow from 127.0.0.1
</Location>

¶Ô Ssh ½øÐÐ Chroot

´ËÍ⣬ÎÒÃÇÖ»Òª°Ñssh½øÐÐchroot²¢ÈÃÄã¿´Ò»¿´ÄÇÑù×öµÄ½á¹û£¨Èç¹ûÄãÖ»×öÁËÕâЩ£¬Äã²»±Ø¹Û²ìÕû¸öϵͳ£©¡£ µ±È»£¬Èç¹ûÄÜ°ÑÈÕÖ¾¼Ç¼ÔÚÍⲿÉ豸ÉϾ͸üºÃÁË¡£ÎÒÃÇÓ¦¸ÃÓÃOpenSSH£¬µ«ÎªÁË·½±ã£¨ÕâºÃÏñ²»ÊÇÒ»¸öºÃµÄ½è¿Ú£©£¬ÎÒÓõÄÊÇÒ»¸öÉÌÒµµÄSSH¡£

Ô´µØÖ·: http://www.ssh.com/products/ssh/download.cfm

ÔÚ/usr/local/ssh_chrootÏ°²×°ssh²¢ÔËÐнű¾¡£

cd /chroot
 # Èç¹ûÄãûÓÐʹÓÃÎÒµÄÅäÖÃÎļþ£¬Çë°ÑÏÂÒ»ÐеÄ×¢ÊÍÈ¥µô¡£
 # ./Config_Chroot.pl config  sshd
./Config_Chroot.pl install sshd
./Config_Chroot.pl start   sshd

°Ñ PostSQL ½øÐÐ Chroot

Ô´´úÂë: ftp://ftp.us.postgresql.org/source/v7.1.3/postgresql-7.1.3.tar.gz

°Ñapache±àÒë²¢°²×°ÔÚÄãϵͳÀïµÄ/usr/local/postgresĿ¼Ï¡£È»ºóÔËÐÐPerl½Å±¾¡£

cd /chroot
 # Èç¹ûÄãûÓÐʹÓÃÎÒµÄÅäÖÃÎļþ£¬Çë°ÑÏÂÒ»ÐеÄ×¢ÊÍÈ¥µô¡£
 # ./Config_Chroot.pl config  postgres
./Config_Chroot.pl install postgres
./Config_Chroot.pl start   postgres

°Ñ Sendmail ½øÐÐ Chroot

cd /chroot
 # Èç¹ûÄãûÓÐʹÓÃÎÒµÄÅäÖÃÎļþ£¬Çë°ÑÏÂÒ»ÐеÄ×¢ÊÍÈ¥µô¡£
 # ./Config_Chroot.pl config  sendmail
./Config_Chroot.pl install sendmail
./Config_Chroot.pl start   sendmail

ºÃÔÚÄãËæʱ¿ÉÒÔ·¢ËÍÓʼþ£¬µ±ÄãÊÕÐŵÄʱºò²Å»á³öÎÊÌâ¡£Òò´Ë£¬ÎÒ¿ÉÒÔ°ÑsendmailºÍapacheÒ»Æð°²×°¶ø²»³öÎÊÌâ¡£ ÎÒµÄһЩPerl½Å±¾»áÏòÍâ·¢ËÍÓʼþ£¬ËùÒÔÎÒÒª°Ñsendmail³ÌÐò¿½±´µ½apacheµÄchroot»·¾³Ï¡£  

¹ØÓÚ Chroot µÄÆäËûһЩÊÂÇé¡£

1. ÄãµÄ»úÆ÷ÉÏ°üÀ¨sendmail, ssh, apache, postgresql, syslogÔÚÄÚµÄËùÓзþÎñ¶¼±ØÐëÔËÐÐÔÚchroot»·¾³Ï¡£
2. ÿһ¸ö·þÎñ¶¼±ØÐëÒÔ·ÇrootÕË»§ÔËÐУ¨ÄãÒ²ÐíÐèÒª°ÑÒÑÊܱ£»¤µÄ¶Ë¿ÚÖض¨Ïòµ½Î´Êܱ£»¤µÃ¶Ë¿Ú¡£Õâ°üÀ¨sendmailºÍsyslog¡£
3. ÈÕÖ¾Ó¦¸ÃÔ¶ÀëÏÖ³¡¡£
4. ¶Ôÿһ¸ö·þÎñ¶¼ÊµÐдÅÅÌÅä¶î£¬ÒÔÏÞÖÆÈëÇÖÕßËùÄÜÕ¼ÓõĴÅÅÌ¡£µ±´ÅÅÌÒÑдÂúʱ£¬ÄãÓ¦¸ÃÔڻػ·É豸ÉÏΪijЩ·þÎñ°²×°Îļþϵͳ¡£
5. ËùÓв»Ðè¸Ä¶¯µÄÎļþµÄÓµÓÐÕßÓ¦¸ÃÊÇrootÕË»§¡£

ÖÁÓÚsyslog£¬ÎÒ»¹Ã»ÓÐÊÔ¹ý£¬µ«ÎÒÈÏΪӦ¸ÃÒÔ·ÇrootÕË»§È¥¼Ç¼ÈÕÖ¾£¬ÎÒÏëÕâÓ¦¸ÃÊÇ¿ÉÐеġ£ ÖÁÉÙÎÒ¿ÉÒÔΪÿһ¸ö·þÎñÔÚchrootµÄ»·¾³Ï¼Ç¼ÈÕÖ¾¡£

ËùÓеķþÎñ¶¼ÒªÔËÐÐÔÚ·ÇrootÕË»§Ï£¬ÉõÖÁÊÇNFS¡£Çë¼Çס£¬ÊÇËùÓеķþÎñ¡£  

½¨Òé

• ÇëÔËÐÐÁ½¸össhdÊØ»¤½ø³Ì£¬²¢½øÐжþ´ÎµÇ¼¡£
• É跨ʹsendmail»òÆäËûÓʼþ³ÌÐòÔËÐÐÔÚ·ÇrootÕË»§Ï¡£
• ɾµô/libϲ»ÐèÒªµÄº¯Êý¿â¡£ÎÒÖ»ÊÇ¿½ÁËÎÒÐèÒªµÄº¯Êý¿âÔÚÉÏÃæ¡£ÆäʵÄã²»ÐèÒªÆäÖеĴ󲿷֡£
• ÇëÓÃsyslogd½øÐÐÔ¶³ÌÈÕÖ¾¼Ç¼£¬¿´¿´ÎÒÃÇÊÇ·ñÄÜÈÃsyslogdÁ¬½Óµ½ÍøÂç¶Ë¿ÚÉϲ¢µÃµ½ÔËÐÐÔڻػ·É豸ÍøÂç¶Ë¿ÚÉϵÄËùÓзþÎñµÄÈÕÖ¾¡£ ¿´¿´ÄÜ·ñʹsyslogdÔËÐÐÔÚ·ÇrootÕË»§Ï¡£

½áÂÛ

ÎÒ¾ø¶ÔÖ§³ÖÈÃËùÓзþÎñ¶¼ÔËÐÐÔÚ·ÇrootȨÏÞµÄchrootµÄ»·¾³Ï£¬Èκβ»ÄÜ×öµ½ÕâÒ»µãµÄ·¢Ðа棬ÎÒ¶¼²»»á¿¼ÂÇÔÚÉú²ú»·¾³ÖÐʹÓÃËü¡£ ÎÒÕýʹËùÓеķþÎñ¶¼ÔËÐÐÔÚchroot»·¾³Ï£¬¾¡ÎҵĿÉÄÜʹԽÀ´Ô½¶àµÄ¶«Î÷ÕâÑùÔËÐÐ -- ×îÖÕ£¬ÎÒ»á´ïµ½ÎÒµÄÀíÏë¡£

ÎÒ´òËãΪchrootдһ¸öHOWTO¡£ÎÒÕý·¢ËÍÇëÇó£¬Ï£Íûij¸öÈËÄܹ»°ÑÎÒÕâƪÎÄÕÂת»»³ÉLyX¸ñʽ£¬ÒÔ±ãËü¿ÉÒԷŵ½LinuxµÃHOWTOÉÏ¡£  

²Î¿¼ÊéÄ¿

1. ÈçÓб䶯£¬Çë¼ûhttp://www.gnujobs.com/Articles/23/chroot.html

¶ÔÕâƪÎÄÕ·¢±íÆÀÂÛ

2002-01-02, generated by lfparser version 2.23