Re: [vox] quake3 serving from behind a firewall
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [vox] quake3 serving from behind a firewall
On Fri, Apr 05, 2002 at 12:50:23AM -0800, ME wrote:
> There have been a slew of security problems with running quake
> servers. (This includes DDoS). No need to explain, the hisory is
> documented "out there."
>
> Make sure your remain current on versions, and look into running
> automated software to detect certain kinds of attacks and kick/ban users.
>
> Also, strongly suggest you set it to run as nobody,nogroup in a chrooted
> env. This raises the bar enough to keep most potential exploits away.
I've done this before. There's a nifty little program called uchroot. It's
like chroot, but it's installed setuid root. It makes the chroot() system
call, then drops privileges. This lets you su to an unprivileged user,
then do the chroot, thus keeping su out of the chrooted environment.
This way, you can keep all setuid-root binaries out of the chroot
environment. Since only root can make the chroot() system call, this
should keep an attacker from breaking out of the jail.
If anyone wants the scripts I use to load Q3 as an unprivileged user in a
chroot environment, send me mail.
--
Samuel Merritt
PGP key is at http://wwwcsif.cs.ucdavis.edu/~merritt/snmerritt.asc
Information about PGP can be found at http://www.mindspring.com/~aegreene/pgp/
Attachment:
pgp00001.pgp
Description: PGP signature
|
