|
I'm a firm believer in chrooting services for some added security. I did
this on FreeBSD 4.7-RELEASE, but this will probably also work on Linux, with
some modifications. First, download and compile psyBNC as usual:
$ fetch http://www.psychoid.lam3rz.de/psyBNC2.3.2-4.tar.gz
$ tar xfvz psyBNC2.3.2-4.tar.gz
$ cd psybnc
$ make menuconfig
$ make
Next, create the chrooted area. I'm using /chroot for my daemons:
$ mkdir /chroot/psybnc
$ cp psybnc /chroot/psybnc/
$ cp psybnc.conf /chroot/psybnc/
Copy over psyBNC's translations:
$ mkdir /chroot/psybnc/lang
$ cp lang/* /chroot/psybnc/lang
Copy over psyBNC's SSL certificates, if you compiled with SSL support:
$ mkdir /chroot/psybnc/key
$ cp key/* /chroot/psybnc/key
Copy over the config files. I got these by running psyBNC with strace:
$ mkdir /chroot/psybnc/etc
$ cp /etc/localtime /chroot/psybnc/etc
$ cp /etc/resolv.conf /chroot/psybnc/etc
$ mkdir -p /chroot/psybnc/usr/share/zoneinfo
$ cp /usr/share/zoneinfo/GMT /chroot/psybnc/usr/share/zoneinfo
$ cp /usr/share/zoneinfo/posixrules /chroot/psybnc/usr/share/zoneinfo
Copy over the libraries. I got these by runnning "ldd
/chroot/psybnc/psybnc":
$ mkdir -p /chroot/psybnc/usr/lib
$ mkdir /chroot/psybnc/usr/libexec
$ cp /usr/lib/libm.so.2 /chroot/psybnc/usr/lib
$ cp /usr/lib/libssl.so.2 /chroot/psybnc/usr/lib
$ cp /usr/lib/libcrypto.so.2 /chroot/psybnc/usr/lib
$ cp /usr/lib/libc.so.4 /chroot/psybnc/usr/lib
$ cp /usr/libexec/ld-elf.so.1 /chroot/psybnc/usr/libexec
If you wish to use psyBNC's SSL encryption to connect to a IRC server, you'll need to create a device nodes for random and urandom inside the chroot. This can be accomplished in FreeBSD 5.x in the following way:
# mknod /chroot/psybnc/dev/random c 249 0
$ ln -s /chroot/psybnc/dev/random /chroot/psybnc/dev/urandom
Note that if you simply wish to use SSL for the connection from your IRC client to the BNC, no device nodes are needed. You are now ready to start psyBNC with the command:
$ chroot /chroot/psybnc ./psybnc
PsyBNC will give you it's PID (process ID) when it starts. You can check that
the chroot is working by doing "ls -al /proc/<psybnc's PID>/file". If the
output is similar to this:
lr-xr-xr-x 1 psybnc psybnc 7 Feb 27 21:57 /proc/<psybnc's PID>/file -> /psybnc
then the chroot is working, congratulations!
On Linux, the same can be accomplished by doing "ls -la
/proc/<psybnc's PID>/root", and it's output should be similar to:
lrwxrwxrwx 1 psybnc psybnc 0 Feb 27 21:57 /proc/<psybnc's PID>/root -> /chroot/psybnc
|
Technical Documents 
