From bc02cbd8939093189712a97ae4df2babeb8d14ce Mon Sep 17 00:00:00 2001 From: Joel Rosdahl Date: Mon, 23 Jun 2014 22:13:32 +0200 Subject: Minor cleanups --- README.md | 80 +++++++++++++++++++++++++++++---------------------------------- 1 file changed, 37 insertions(+), 43 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index d40837a..8a9ea19 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ Features * No configuration. * No ident lookup (so that people behind firewalls that filter the ident port without sending NACK can connect without long timeouts). -* Reasonably secure when used with --chroot and --setuid +* Reasonably secure when used with --chroot and --setuid. Limitations ----------- @@ -45,54 +45,48 @@ help. Using --chroot and --setuid --------------------------- -In order to use the --chroot or --setuid options, you must be using an OS -that supports these functions (most \*nixes), and you must start the server -as root. These options limit the daemon process to a small -subset of the filesystem, running with the privileges of the specified -user (ideally unprivileged) instead of the user who launched miniircd. +In order to use the --chroot or --setuid options, you must be using an OS that +supports these functions (most \*nixes), and you must start the server as root. +These options limit the daemon process to a small subset of the filesystem, +running with the privileges of the specified user (ideally unprivileged) +instead of the user who launched miniircd. -To create a new chroot jail for miniircd, edit the Makefile and change -JAILDIR and JAILUSER to suit your needs, then run ``make jail`` as root. -If you have a motd file or an SSL pem file, you'll need to put them in the -jail as well: +To create a new chroot jail for miniircd, edit the Makefile and change JAILDIR +and JAILUSER to suit your needs, then run ``make jail`` as root. If you have a +motd file or an SSL pem file, you'll need to put them in the jail as well: -``` -# cp miniircd.pem motd.txt /var/jail/miniircd -``` + + # cp miniircd.pem motd.txt /var/jail/miniircd Remember to specify the paths for --statedir, --logdir, --motd, and --ssl-pem-file from within the jail, e.g.: -``` -# sudo miniircd --statedir=/ --logdir=/ --motd=/motd.txt --setuid=nobody \ - --ssl-pem-file=/miniircd.pem --chroot=/var/jail/miniircd -``` - -Make sure your jail is writable by whatever user/group you are running -the server as. Also, keep your jail clean. Ideally it should only contain -the files mentioned above and the state/log files from miniircd. You should -**not** place the miniircd script itself, or any executables, in the jail. -In the end it should look something like this: - -``` -# ls -alR /var/jail/miniircd -.: -total 36 -drwxr-xr-x 3 nobody root 4096 Jun 10 16:20 . -drwxr-xr-x 4 root root 4096 Jun 10 18:40 .. --rw------- 1 nobody nobody 26 Jun 10 16:20 #channel --rw-r--r-- 1 nobody nobody 1414 Jun 10 16:51 #channel.log -drwxr-xr-x 2 root root 4096 Jun 10 16:19 dev --rw-r----- 1 rezrov nobody 5187 Jun 9 22:25 ircd.pem --rw-r--r-- 1 rezrov nobody 17 Jun 9 22:26 motd.txt - -./dev: -total 8 -drwxr-xr-x 2 root root 4096 Jun 10 16:19 . -drwxr-xr-x 3 nobody root 4096 Jun 10 16:20 .. -crw-rw-rw- 1 root root 1, 3 Jun 10 16:16 null -crw-rw-rw- 1 root root 1, 9 Jun 10 16:19 urandom -``` + # sudo miniircd --statedir=/ --logdir=/ --motd=/motd.txt --setuid=nobody \ + --ssl-pem-file=/miniircd.pem --chroot=/var/jail/miniircd + +Make sure your jail is writable by whatever user/group you are running the +server as. Also, keep your jail clean. Ideally it should only contain the files +mentioned above and the state/log files from miniircd. You should **not** place +the miniircd script itself, or any executables, in the jail. In the end it +should look something like this: + + # ls -alR /var/jail/miniircd + .: + total 36 + drwxr-xr-x 3 nobody root 4096 Jun 10 16:20 . + drwxr-xr-x 4 root root 4096 Jun 10 18:40 .. + -rw------- 1 nobody nobody 26 Jun 10 16:20 #channel + -rw-r--r-- 1 nobody nobody 1414 Jun 10 16:51 #channel.log + drwxr-xr-x 2 root root 4096 Jun 10 16:19 dev + -rw-r----- 1 rezrov nobody 5187 Jun 9 22:25 ircd.pem + -rw-r--r-- 1 rezrov nobody 17 Jun 9 22:26 motd.txt + + ./dev: + total 8 + drwxr-xr-x 2 root root 4096 Jun 10 16:19 . + drwxr-xr-x 3 nobody root 4096 Jun 10 16:20 .. + crw-rw-rw- 1 root root 1, 3 Jun 10 16:16 null + crw-rw-rw- 1 root root 1, 9 Jun 10 16:19 urandom License ------- -- cgit v1.2.3