Date: Tue, 15 Jul 2003 11:12:11 +0200 From: Pawel Jakub Dawidek <nick@garage.freebsd.pl> To: Uwe Doering <gemini@geminix.org> Cc: "V. Jones" <vjones62@earthlink.net> Subject: Re: jails, ipfilter & stunnel Message-ID: <20030715091211.GK4973@garage.freebsd.pl> In-Reply-To: <3F13A975.7020508@geminix.org> References: <8213881.1058211676830.JavaMail.nobody@beaker.psp.pas.earthlink.net> <20030714211518.GD4973@garage.freebsd.pl> <3F13A975.7020508@geminix.org>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On Tue, Jul 15, 2003 at 09:12:53AM +0200, Uwe Doering wrote: +> >My advice is simple: every jail and main host should have its own IP +> >address. +> +> This is certainly the best solution, if you have multiple IP addresses +> at your disposal. What I was trying to point out is that there is no +> _technical_ reason for separate IP addresses with regard to FreeBSD's +> jail implementation. In cases where you cannot easily get additional IP +> addresses, on a rented server in a data center, for instance, running +> multiple jails on the same IP address (with the necessary safety +> precautions like binding daemons to IP addresses explicitly) is still +> far better than no jails at all. The difference is that it takes at +> least some skill and insight into FreeBSD internals to compromise the +> system as a whole in the former case, while in the latter each and every +> script kiddy can take over your entire server in no time. IMHO security solutions that are "harder to break", aren't security solutions. There is secure method, you can always use CerbNG:) http://cerber.sourceforge.net Now you need to create such policy: if (syscall == SYS_bind && isjailed() && (getfamily(arg[1]) == AF_INET || getfamily(arg[1]) == AF_INET6)) { permit = 1; port = getport(arg[1]); host = getjailhost(); if (host == "apache" && port != 80 && port != 443) { permit = 0; } if (host == "smtp" && port != 25) { permit = 0; } if (host == "pop3" && port != 110 && port != 995) { permit = 0; } if (!permit) { log(LOG_WARNING, "CerbNG: Process %s [pid=%u] from jail %s " "is trying to bind to port %u!", pname, pid, host, port); return EPERM; } } Now processes jailed in prison with hostname "apache" could bind only to port 80 or 443, etc. -- Pawel Jakub Dawidek pawel@dawidek.net UNIX Systems Programmer/Administrator http://garage.freebsd.pl Am I Evil? Yes, I Am! http://cerber.sourceforge.net [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (FreeBSD) iQCVAwUBPxPFaz/PhmMH/Mf1AQEDXwP9GqApjaNXuG8u5WeWIjTyjrQKjYjh6R0g g2zCwmmaVKoYLmgT6cSNPzbrLiBqtWlVuzwLKhK0F/gDhZ3LknWQtaMUWKgl3V5R aEZ/N4TavzvJnPoTDV37NHBXRkPNrOnhZTgnNqCJF7VX5v6RhGfcj67oYkfcQUO7 dvKPG5c4xgk= =rPX1 -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030715091211.GK4973>