Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-06 Thread Martynas Domarkas
OK people. I'm not sure that I had reason to do it - you will tell me. I wrote a script for chrooting applications (FOR DEBIAN ONLY). You can find it: http://joker.hansabank.lt/mkchroot I tried to chroot perl, apache, libapache-mod-ssl. I think it should chroot php4 and phplib. CGI runs as on no

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-05 Thread Martynas Domarkas
OK people. I'm not sure that I had reason to do it - you will tell me. I wrote a script for chrooting applications (FOR DEBIAN ONLY). You can find it: http://joker.hansabank.lt/mkchroot I tried to chroot perl, apache, libapache-mod-ssl. I think it should chroot php4 and phplib. CGI runs as on no

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-05 Thread Matt Zimmerman
On Sun, Jan 05, 2003 at 12:59:47PM +0100, Adrian Phillips wrote: > > "Stefano" == Stefano Salvi <[EMAIL PROTECTED]> writes: > > Stefano> I'm setting up my new server, based on Debian Woody. I > Stefano> have to host our school website. This site uses parts > Stefano> written in

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-05 Thread Matt Zimmerman
On Sun, Jan 05, 2003 at 12:59:47PM +0100, Adrian Phillips wrote: > > "Stefano" == Stefano Salvi <[EMAIL PROTECTED]> writes: > > Stefano> I'm setting up my new server, based on Debian Woody. I > Stefano> have to host our school website. This site uses parts > Stefano> written in

Re: [d-security] Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-05 Thread Christian Hammers
Hi On Sat, Jan 04, 2003 at 09:00:45PM +0200, Martynas Domarkas wrote: > Hi, I'm currently trying to use makejail... it does not work very good. > Simple way is copy /bin/bash with libraries (try ldd /bin/bash to find > out which libs you need), so you can do chroot /your/chroot/dir. After > do dpk

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-05 Thread Pablo Marín Ramón
El sáb, ene 04, 2003 at 10:34:34 -0500, George Georgalis escribió: > http://www-106.ibm.com/developerworks/linux/library/l-freevsd.html > http://www.freevsd.org/ > freeVSD is an advanced web-hosting platform. It allows multiple Virtual > Servers to be created on a single hosting server. vserver (

Re: [d-security] Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-05 Thread Christian Hammers
Hi On Sat, Jan 04, 2003 at 09:00:45PM +0200, Martynas Domarkas wrote: > Hi, I'm currently trying to use makejail... it does not work very good. > Simple way is copy /bin/bash with libraries (try ldd /bin/bash to find > out which libs you need), so you can do chroot /your/chroot/dir. After > do dpk

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-05 Thread Adrian Phillips
> "Stefano" == Stefano Salvi <[EMAIL PROTECTED]> writes: Stefano> I'm setting up my new server, based on Debian Woody. I Stefano> have to host our school website. This site uses parts Stefano> written in PHP4, and some CGIs. I also want to setup Stefano> tomcat for a future p

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-05 Thread Pablo Marín Ramón
El sáb, ene 04, 2003 at 10:34:34 -0500, George Georgalis escribió: > http://www-106.ibm.com/developerworks/linux/library/l-freevsd.html > http://www.freevsd.org/ > freeVSD is an advanced web-hosting platform. It allows multiple Virtual > Servers to be created on a single hosting server. vserver (

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-05 Thread Martynas Domarkas
The first thing I do not like is that makejail needs a lot of additional software: python, stat, file etc.. As we all know, on production systems is better to have less software because of potential security holes. OK, we can remove all software after instalation, but how to upgrade then chrooted a

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-05 Thread Adrian Phillips
> "Stefano" == Stefano Salvi <[EMAIL PROTECTED]> writes: Stefano> I'm setting up my new server, based on Debian Woody. I Stefano> have to host our school website. This site uses parts Stefano> written in PHP4, and some CGIs. I also want to setup Stefano> tomcat for a future p

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-05 Thread Martynas Domarkas
The first thing I do not like is that makejail needs a lot of additional software: python, stat, file etc.. As we all know, on production systems is better to have less software because of potential security holes. OK, we can remove all software after instalation, but how to upgrade then chrooted a

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-04 Thread George Georgalis
On Sun, Jan 05, 2003 at 01:16:31AM +0100, Javier Fern?ndez-Sanguino Pe?a wrote: >On Sat, Jan 04, 2003 at 09:00:45PM +0200, Martynas Domarkas wrote: >> Hi, I'm currently trying to use makejail... it does not work very good. > > Could you elaborate more on this? I would like to know which issue

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-04 Thread Alain Tesio
On Fri, 03 Jan 2003 18:19:43 +0100 Stefano Salvi <[EMAIL PROTECTED]> wrote: > Makejail from testing has a script about apache, but does it support Tomcat > and PHP4? > And how about CGIs? It supports php and CGIs, I've tested it with a search engine with php/mysql, I'm about to use it for phpnuk

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-04 Thread George Georgalis
On Sun, Jan 05, 2003 at 01:16:31AM +0100, Javier Fern?ndez-Sanguino Pe?a wrote: >On Sat, Jan 04, 2003 at 09:00:45PM +0200, Martynas Domarkas wrote: >> Hi, I'm currently trying to use makejail... it does not work very good. > > Could you elaborate more on this? I would like to know which issue

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-04 Thread Phillip Hofmeister
A word of caution to chrooters, make sure when a library gets updated for security you copy the updated library into the jail and then restart all jailed applications... -- Phil PGP/GPG Key: http://www.zionlth.org/~plhofmei/ wget -O - http://www.zionlth.org/~plhofmei/key.txt | gpg --import -- Ex

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-04 Thread Alain Tesio
On Fri, 03 Jan 2003 18:19:43 +0100 Stefano Salvi <[EMAIL PROTECTED]> wrote: > Makejail from testing has a script about apache, but does it support Tomcat > and PHP4? > And how about CGIs? It supports php and CGIs, I've tested it with a search engine with php/mysql, I'm about to use it for phpnuk

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-04 Thread Javier Fernández-Sanguino Peña
On Sat, Jan 04, 2003 at 09:00:45PM +0200, Martynas Domarkas wrote: > Hi, I'm currently trying to use makejail... it does not work very good. Could you elaborate more on this? I would like to know which issues have you come up with. Also, you might want to take a loot at the (recen

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-04 Thread Phillip Hofmeister
A word of caution to chrooters, make sure when a library gets updated for security you copy the updated library into the jail and then restart all jailed applications... -- Phil PGP/GPG Key: http://www.zionlth.org/~plhofmei/ wget -O - http://www.zionlth.org/~plhofmei/key.txt | gpg --import -- Ex

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-04 Thread Javier Fernández-Sanguino Peña
On Sat, Jan 04, 2003 at 09:00:45PM +0200, Martynas Domarkas wrote: > Hi, I'm currently trying to use makejail... it does not work very good. Could you elaborate more on this? I would like to know which issues have you come up with. Also, you might want to take a loot at the (recen

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-04 Thread Martynas Domarkas
Hi, I'm currently trying to use makejail... it does not work very good. Simple way is copy /bin/bash with libraries (try ldd /bin/bash to find out which libs you need), so you can do chroot /your/chroot/dir. After do dpkg -L apache and copy contents of apache package to chroot, also repeat it with

Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-04 Thread Stefano Salvi
I'm setting up my new server, based on Debian Woody. I have to host our school website. This site uses parts written in PHP4, and some CGIs. I also want to setup tomcat for a future possible use of JSP an servlets. I think it would be wise to put all this stuff in a chroot jail, but I wonder if

Re: Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-04 Thread Martynas Domarkas
Hi, I'm currently trying to use makejail... it does not work very good. Simple way is copy /bin/bash with libraries (try ldd /bin/bash to find out which libs you need), so you can do chroot /your/chroot/dir. After do dpkg -L apache and copy contents of apache package to chroot, also repeat it with

Putting Apache, PHP, Tomcat and CGI in a jail

2003-01-04 Thread Stefano Salvi
I'm setting up my new server, based on Debian Woody. I have to host our school website. This site uses parts written in PHP4, and some CGIs. I also want to setup tomcat for a future possible use of JSP an servlets. I think it would be wise to put all this stuff in a chroot jail, but I wonder if i