4

I have to provide a few, reasonably complete, chrooted ssh accesses to a very small system where disk space is at a premium.

I was considering doing something along the lines:

mkdir -p newroot/usr newroot/home/user newroot/lib newroot/bin newroot/var
mount -o bind,ro /bin newroot/bin
mount -o bind,ro /lib newroot/lib
mount -o bind,ro /usr newroot/usr

instead of the more traditional copy.

Is that an acceptable practice or am I opening exploitation avenues?

2

The main things to be mindful of: - If you mount full directories, you effectively give chrooted user access to all those resources (most notably binaries). It would be more secure to only put required binaries into chroot (i.e. in one case I had to provide access to ls and scp only, but nothing else). This will potentially limit attack surface, as there would be fewer executables to exploit. - On the other hand, mounting those directories allows to keep chrooted resources up to date, potentially limiting explotable vulnerabilities. But this can be achieved by updating chrooted resources manually or via scheduled script.

Overall, keeping chrooted environment fully separate is considered more secure. But it all ultimately depends on your level of paranoia, criticality of this system and other security controls you might have in place.

  • Just realized this is a pretty old question - hope it is ok with site rules to reply to these. Maybe to for the author's sake, but others who search for the same thing. – Iaroslav Oct 7 '16 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.