ЛУЧШИХ ВИРУСОВ - Xakep Online

ХАКЕР.PRO
SYN/ACK
Ïàðà ñëîâ îá nginx
Nginx (engine x) — âûñîêîïðîèçâîäèòåëüíûé è íåòðåáîâàòåëüíûé
ê ðåñóðñàì HTTP-ñåðâåð è ïî÷òîâûé ïðîêñè. Îáû÷íî èñïîëüçóåòñÿ
â êà÷åñòâå HTTP-àêñåëåðàòîðà, ïåðåäàþùåãî âñå çàïðîñû
ê apache, èëè ëåãêîâåñíîãî ñåðâåðà äëÿ îòäà÷è ñòàòè÷åñêîãî
êîíòåíòà. Ïðèìåíÿåòñÿ íà wordpress.com è áîëüøèíñòâå ñåðâåðîâ
Ðàìáëåðà. Ðàçðàáàòûâàåòñÿ Èãîðåì Ñûñîåâûì ñ 2002-ãî ãîäà.
# mkdir $JAIL/{dev,tmp}
# chmod 7777 $JAIL/tmp
Ñìîíòèðóåì ôàéëîâóþ ñèñòåìó devfs:
# mount -t devfs devfs $JAIL/dev
Ñîçäàäèì IP-ïñåâäîíèì è íàñòðîèì áðàíäìàóýð íà ðåäèðåêò HTTP-òðàôèêà
íà IP-àäðåñ òþðüìû:
# ifconfig ed0 inet alias 192.168.0.1/16
# ipfw add fwd 192.168.0.1,80 tcp from any to âíåøíèé-ip 80
Îòêðîåì êîíôèãóðàöèîííûé ôàéë nginx è ïðèâåäåì ñåêöèþ server ê ñëåäóþùåìó
âèäó:
# vi /usr/jail/nginx/etc/nginx/nginx.conf
server {
listen 80;
server_name www.host.ru;
location / {
proxy_pass http://127.0.0.1:8080/;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_
forwarded_for;
client_max_body_size 10m;
client_body_buffer_size 128k;
Ïåðåìåííûå sysctl,
î êîòîðûõ íóæíî
çíàòü
1 security.jail.set_hostname_allowed — ìîæåò ëè jail-ñóïåðïîëüçîâàòåëü
èçìåíÿòü ñåòåâîå èìÿ (hostname) jail-ñåðâåðà. Èìååò
ñìûñë îòêëþ÷èòü, åñëè äëÿ òþðüìû âûäåëåíî íàñòîÿùåå ñåòåâîå
èìÿ, ïðîïèñàííîå â DNS-çîíàõ. 2 security.jail.allow_raw_sockets —
ðàçðåøèòü jail-ñóïåðïîëüçîâàòåëþ ñîçäàâàòü raw-ñîêåòû. Â öåëÿõ
áåçîïàñíîñòè îïöèÿ îòêëþ÷åíà, íî îíà ìåøàåò ïðàâèëüíîé ðàáîòå
íåêîòîðûõ èíñòðóìåíòîâ, ïðåäíàçíà÷åííûõ äëÿ îòëàäêè ñåòè.
3 security.jail.chflags_allowed — ïîçâîëèòü jail-ïðîöåññàì ìîäèôèöèðîâàòü
ôëàãè ÔÑ (chflags). Ïî óìîë÷àíèþ âûêëþ÷åíà, ÷òî
îòêðûâàåò èíòåðåñíûå âîçìîæíîñòè äëÿ ïîìåùåíèÿ â jail íåóäàëÿåìûõ,
íå÷èòàåìûõ èëè íåçàïèñûâàåìûõ ôàéëîâ.
×òîáû nginx ñòàðòîâàë ïðè çàãðóçêå, äîáàâèì â /etc/rc.conf ñëåäóþùå
çàïèñè:
# vi /etc/rc.conf
ifconfig_ed0_alias0="inet 192.168.0.1"
jail_enable="YES"
jail_list="nginx"
jail_nginx_rootdir="/usr/jail/nginx"
jail_nginx_hostname="nginx.jail"
jail_nginx_ip="192.168.0.1"
// Ïîëíàÿ èíèöèàëèçàöèÿ îêðóæåíèÿ íå íóæíà, äîñòàòî÷íî
ñðàçó çàïóñòèòü ñåðâèñ
jail_nginx_exec_start="/sbin/nginx -c /etc/nginx/nginx.
conf"
// Îñòàíàâëèâàòü nginx âðó÷íóþ òàêæå íå òðåáóåòñÿ, ïåðåä
çàâåðøåíèåì ðàáîòû jail àêêóðàòíî óáüåò âñå ñâîè ïðîöåññû
ñ ïîìîùüþ kill
jail_nginx_exec_stop=""
// Íàì ïîíàäîáèòñÿ òîëüêî devfs
jail_nginx_devfs_enable="YES"
jail_nginx_fdescfs_enable="NO"
jail_nginx_procfs_enable="NO"
}
}
114
proxy_connect_timeout 90;
proxy_send_timeout 90;
proxy_read_timeout 90;
proxy_buffer_size 4k;
proxy_buffers 4 32k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
Ó÷òè, ÷òî õèòðàÿ ñèñòåìà ïîðòîâ èçìåíèëà äåôîëòîâûå ïóòè ïîèñêà ôàéëîâ â
nginx, äîáàâèâ ê íèì ïðåôèêñ /usr/jail/nginx. Ïîýòîìó âñå îòíîñèòåëüíûå ïóòè
â ôàéëå êîíôèãóðàöèè ïðèäåòñÿ çàìåíèòü íà àáñîëþòíûå, òî åñòü — ïðîïèñàòü
âìåñòî «include mime.types;» ñòðîêó «include /etc/nginx/mime.types;». Âñå,
òåïåðü âèðòóàëüíûé ñåðâåð ñ nginx ìîæíî çàïóñòèòü (îïöèÿ ‘-c’ ïîçâîëÿåò ïåðåïèñàòü
íåâåðíûé äåôîëòîâûé ïóòü ïîèñêà êîíôèãóðàöèîííîãî ôàéëà):
# jail /usr/jail/nginx nginx.jail 192.168.0.1 /sbin/nginx
-c /etc/nginx/nginx.conf
Ïî îïèñàííîé ñõåìå â òþðüìó ìîæíî ïîñàäèòü ïðàêòè÷åñêè ëþáîé ñåðâèñ,
íå îòÿãîùåííûé ìíîæåñòâîì çàâèñèìîñòåé.  íåêîòîðûõ ñëó÷àÿõ
ïðèäåòñÿ ïîâîçèòüñÿ ñ ñîçäàíèåì ôàéëîâ è êàòàëîãîâ, à òàêæå ñ îòñëåæèâàíèåì
íåîáõîäèìûõ áèáëèîòåê (íåêîòîðûå ñåòåâûå ñåðâåðû, íàïðèìåð
sshd, çàãðóæàþò áèáëèîòåêè âî âðåìÿ èñïîëíåíèÿ, òàê ÷òî ldd ïîêàæåò íå
âñå, è ïðèäåòñÿ âîñïîëüçîâàòüñÿ lsof). Ïðîáëåìó òàêæå ïðåäñòàâëÿåò /dev.
Âåñüìà îïðîìåò÷èâî îòêðûâàòü âñå ôàéëû ýòîãî êàòàëîãà íà ÷òåíèå, à óæ
òåì áîëåå, íà çàïèñü, — ïîýòîìó äëÿ ðåãóëèðîâàíèÿ ïðàâ äîñòóïà íåîáõîäèìî
èñïîëüçîâàòü ñïåöèàëüíûå íàñòðîéêè devfs. Ôàéë /etc/defaults/
devfs.rules ñîäåðæèò áàçîâûå ïðàâèëà devfs äëÿ jail. Ïî óìîë÷àíèþ îí îòêðûâàåò
äîñòóï ê ïîäñîáíûì ñèíòåòè÷åñêèì ôàéëàì, òàêèì êàê /dev/
null è /dev/random, à òàêæå ïñåâäîòåðìèíàëàì. Äëÿ áîëüøèíñòâà êîíôèãóðàöèé
íàñòðîéêè äàæå íå ïðèäåòñÿ ðåäàêòèðîâàòü, äîñòàòî÷íî ñêîïèðîâàòü
ôàéë â êàòàëîã /etc è äîáàâèòü â /etc/rc.conf ñëåäóþùóþ çàïèñü:
jail_èìÿ_devfs_ruleset="devfsrules_jail"
Åñëè æå ïîíàäîáÿòñÿ äîïîëíèòåëüíûå ôàéëû óñòðîéñòâ, òî devfs.rules
ëåãêî îòðåäàêòèðîâàòü, äîáàâèâ íåîáõîäèìûå ïðàâèëà. Ñèíòàêñèñ ôàéëà
è ïðàâèë îïèñàíû íà man-ñòðàíèöàõ devfs(8) è devfs.rules(5). z
XÀÊÅÐ 04 /124/ 09