Nginx and Tomcat use Chroot (jail) related configuration

This article focuses on configuration records, and the benefits of chroot (jail) do not repeat.

This article is divided into three parts: Configuring the basic chroot jail,nginx configuration chroot jail,tomcat configuration Chrootjail.

1. Configure the basic chroot jail

1.1. Create a directory as the root directory of the Chroot jail.

# Mkdir/home/chroot/jail

1.2. Use the LDD command to find the dependent libraries of the commands you want to run in chroot jail.

# ldd/bin/bashlinux-vdso.so.1 =  (0x00007fff56fcc000) libtinfo.so.5 =/lib64/libtinfo.so.5 ( 0x0000003ad1200000) libdl.so.2 =/lib64/libdl.so.2 (0x0000003abe600000) libc.so.6 =/lib64/libc.so.6 ( 0x0000003abe200000)/lib64/ld-linux-x86-64.so.2 (0x0000003abde00000)

1.3. Create a subfolder of the Chroot jail root directory, what you want to run under chroot, create something, and remember the principle of service minimization.

# mkdir/home/chroot/jail/bin# Mkdir/home/chroot/jail/lib64

1.4. Copy the binaries (which need to run under chroot) and dependent libraries into the chroot jail directory.

# cp/bin/bash/home/chroot/jail/bin# cp/lib64/{libtinfo.so.5,libdl.so.2,libc.so.6,ld-linux-x86-64.so.2} \  / Home/chroot/jail/lib64

1.5. Complete the above operation, you can go into the chroot under the view.

The above operation is only able to run bash again chroot, other operations can not. Thus the LS command in the following example cannot be found

# chroot/home/chroot/jailbash-4.1# pwd/bash-4.1# Lsbash:ls:command not foundbash-4.1# exitexit#

You can only run some inline shells, such as PWD, but no other instructions, unless you copy the binaries and dependent libraries into chroot jail.

1.6. If starting a service is always an error, you can use Strace to check for errors. The Nginx configuration will be added at the end.

2.nginx Configuration Chroot Jail

Nginx installation method is omitted, is to download tar.gz, decompression, configure,make,make install ...

This is configured for centos6.x 64-bit systems.

2.1. Specify the chroot directory, which is 1.1. The root directory that is said.

For a unified naming convention, the following directory structure is made:

# d=/home/nginx/jail# Mkdir-p $D

2.2. Create an isolated environment, jail subdirectories under the root directory.

# mkdir-p $D/etc# mkdir-p $D/dev# mkdir-p $D/var# mkdir-p $D/usr# mkdir-p $D/usr/local/nginx# mkdir-p $D/tmp# chmod 1777 $D/tmp# mkdir-p $D/var/tmp# chmod 1777 $D/var/tmp# mkdir-p $D/lib64

2.3. Create the required device in $d/dev, which should be a buffer.

Here you use the Mknod command to create the cache file:

#/bin/mknod-m 0666 $D/dev/null C 1 3#/bin/mknod-m 0666 $D/dev/random C 1 8#/bin/mknod-m 0444 $D/dev/urandom C 1 9

2.4. Copy all the Nginx files into the jail.

#/bin/cp-farv/usr/local/nginx/* $D/usr/local/nginx

2.5. Copy the dependent library into jail. (2.5 and 2.4 are equivalent to 1.4 of the process)

# Ldd/usr/local/nginx/sbin/nginx

What to copy and minimize the service.

2.6. Copy/etc to jail.

The Nixcraft tutorial specifically points out that these should be something that Nginx will use when running.

# cp-fv/etc/{group,prelink.cache,services,adjtime,shells,gshadow,shadow,hosts.deny,localtime,nsswitch.conf, NSCD.CONF,PRELINK.CONF,PROTOCOLS,HOSTS,PASSWD,LD.SO.CACHE,LD.SO.CONF,RESOLV.CONF,HOST.CONF} $D/etc

Add some folders:

# CP-AVR/ETC/{LD.SO.CONF.D,PRELINK.CONF.D} $D/etc

2.7. Start Nginx.

If you have an nginx that is running, you must first close it:

# killall-9 Nginx

To open Nginx in chroot:

#/usr/sbin/chroot/home/nginx/jail/usr/local/nginx/sbin/nginx-t#/usr/sbin/chroot/home/nginx/jail/usr/local/ Nginx/sbin/nginx

can also be advanced chroot, and then open:

# chroot/home/nginx/jail bash-4.1#/usr/local/nginx/sbin/nginx-tbash-4.1#/usr/local/nginx/sbin/nginx

Configure it to start:

# echo '/usr/sbin/chroot/home/nginx/jail/usr/local/nginx/sbin/nginx ' >>/etc/rc.local

To edit an nginx configuration file in Chroot:

# cd/home/nginx/jail/usr/local/nginx/conf/# VI nginx.conf

After the save is closed, test and restart Nginx:

#/usr/sbin/chroot/home/nginx/jail/usr/local/nginx/sbin/nginx-t#/usr/sbin/chroot/home/nginx/jail/usr/local/ Nginx/sbin/nginx-s Reload

If the direct copy of the chroot environment, Nginx may not be configured file recognition, execution:

#/usr/sbin/chroot/home/nginx/jail/usr/local/nginx/sbin/nginx-c/usr/local/nginx/conf/nginx.conf

Re-test and restart Nginx.
2.8. If the environment is still problematic, use strace to track errors. (This method configures Tomcat or other services to be tried, and will not repeat later)

Strace may need to be installed.
After executing the statement, there will be some trace, in the/tmp/nginx.strace file, there will be more detailed tracking.

When you configure the environment, it is the son of the file found that a package was missing, add it to chroot jail, start normal.

3.tomcat Configuration Chroot Jail

3.1. Create the Chroot jail root directory.

# Mkdir/home/tomcat/jail

3.2. Create the Chroot jail directory structure.

# cd/home/tomcat/jail# Mkdir-p lib lib64 etc tmp Dev usr# chmod 755 etc Dev usr# chmod 1777 tmp

# cp-a/etc/hosts etc/hosts

3.3. Install the Java environment and copy the root installation environment into the chroot.

# mkdir-p usr/java# cp-a/usr/java/jdk1.7.0_67 Usr/java

3.4. Find a dependent library that copies Java

# ldd/usr/java/jdk1.7.0_67/bin/javalinux-vdso.so.1 =  (0x00007fff532d1000) libpthread.so.0 =/lib64/ libpthread.so.0 (0x00007fc36c8f2000) libjli.so =/usr/java/jdk1.7.0_67/bin/. /lib/amd64/jli/libjli.so (0x00007fc36c6da000) libdl.so.2 =/lib64/libdl.so.2 (0x00007fc36c4d6000) libc.so.6 = /lib64/libc.so.6 (0x00007fc36c142000)/lib64/ld-linux-x86-64.so.2 (0x00007fc36cb17000)

Only the libraries in the above 4 lib64 are copied, and the libraries required by the 2 JVM need to be copied:

# cp-p/lib64/libm.so.6 lib64/# cp-p/lib64/libnsl.so.1 lib64/

3.5. Before running the JVM, some work is needed to make the chroot more like a real root environment.

Create the/dev and its subkeys:

# cd/home/tomcat/jail# mkdir-p/home/tomcat/jail/dev/pts#/dev/makedev-d/home/tomcat/jail/dev null random urandom Zero loop* log console# cp/dev/makedev/home/tomcat/jail/dev# cp-a/dev/shm/home/tomcat/jail/dev/

3.6. Mount the/proc.

# mkdir-p/home/tomcat/jail/proc# mount-t proc Proc/home/tomcat/jail/proc

After this step is mounted, you can use Java under Chroot, and you can enter chroot to test with the following command:

bash-4.1#/usr/java/jdk1.7.0_67/bin/java-version

Amount: The premise is that you have already made a copy of the Bash,sh in Chroot. Or this 3.x all finished, and then also wide to the DA ~

3.7. Add additional required files and dependent libraries.

Copy etc under the three files, do not need to try not to copy, or the sentence. Service minimized.

There are also three named supported dependent libraries that need to be copied

Cp-p/lib64/libresolv.so.2 lib64/cp-p/lib64/libnss_dns.so.2 lib64/cp-p/lib64/libnss_files.so.2 lib64/

Then the/bin/bash and/bin/sh do chroot, refer to 1.x. Where SH is a soft connection to bash in CentOS.

After this step, Java in the chroot can work, and then error to use Strace troubleshooting.

Once the Java runtime is set up, start configuring Tomcat.

3.8.tomcat installation configuration.

Tomcat generally do not need to install, is a green bar, download unpacking package, in the Chroot jail directory to extract.

I was directly compressed in the jail root directory.

Try to run, there will be the following results:

bash-4.1#/apache-tomcat-7.0.57/bin/catalina.sh start                      /apache-tomcat-7.0.57/bin/catalina.sh:line 102:uname: Command not found/apache-tomcat-7.0.57/bin/catalina.sh:line 122:dirname:command not foundcannot find//bin/ Setclasspath.shthis file is needed to run

The uname and dirname two binaries and dependent libraries need to be copied in the same way as bash.

# cp/bin/uname bin/# mkdir usr/bin# cp/usr/bin/dirname usr/bin

When you run Tomcat, you find a little bit of a problem:

bash-4.1#/apache-tomcat-7.0.57/bin/catalina.sh Start/apache-tomcat-7.0.57/bin/catalina.sh:line 203:tty:command Not foundusing catalina_base:   /apache-tomcat-7.0.57using catalina_home:   /apache-tomcat-7.0.57using Catalina_tmpdir:/apache-tomcat-7.0.57/tempusing jre_home:        /usr/java/jdk1.7.0_67using CLASSPATH:       / apache-tomcat-7.0.57/bin/bootstrap.jar:/apache-tomcat-7.0.57/bin/tomcat-juli.jar/apache-tomcat-7.0.57/bin/ Catalina.sh:line 368:touch:command not foundtomcat started.

Add a few more things:

# cp-p/lib64/librt.so.1 lib64/# cp/usr/bin/tty usr/bin/# cp/bin/touch bin/

In this way, Tomcat can function properly in the chroot container.

Configure it to start, append at the end of Rc.local:

Export Java_home=/usr/local/java/jdk1.7.0_25export jre_home= $JAVA _home/jremount-t proc Proc/home/tomcat/jail/proc &>/dev/null/usr/sbin/chroot/home/tomcat/jail/usr/tomcat/bin/catalina.sh start

Note that the Java path, root and chroot to be consistent.

Reference documents:

[1] 3.13 Configuring and Using Chroot jails Chapter 3 implementing Oracle Linux Security Guide for Release 6

[2] Linux nginx:chroot (Jail) Setup by Nixcraft

[3] Tomcat:the Definitive guide:the Definitive Guide by Jason Brittain, Ian F. Darwin

The above describes Nginx and Tomcat using Chroot (jail) related configuration, including aspects of the content, I hope that the PHP tutorial interested in a friend to help.

