Chroot, Ubuntu 10.04, and rssh

Days of effort have finally paid off; I have managed to establish an chroot jail for a project I was working on.

A chroot jail is basically a less-secure virtual machine.  User “A” logs into a machine and thinks he is in root (when he really is in /usr/foo/bar/).  If he has a sufficiently locked-down environment (such as the one that rssh provides), he will not be able to break out of his little cage and modify important system files.  However, as a result of his confinement, he will also not be able to access other system resources – including shell files.

Herein lies the crux of the problem.  It isn’t clear to me what files are needed and what files are not needed to establish a basic SCP or SSH connection.  The following worked in my case.

  1. Install rssh (sudo apt-get install rssh)
  2. Install scponly (sudo apt-get install scponly)
  3. Copy the scponly files to /foo/bar (or wherever you are making your jail)
  4. Copy the /lib/ directory files to /foo/bar/lib (as it appears that not all files needed are copied)
  5. Modify the /foo/bar/etc/passwd file (sudo chmod a+r /foo/bar/etc/passwd) and eliminate all users you don’t need in it.
  6. Create a new user (sudo useradd -m -d /chroot/restricted_user -s /usr/bin/rssh restricted_user) and copy over his information from /etc/passwd to /foo/bar/etc/passwd
  7. Your Chroot is working!  (Be sure toedit /etc/rssh.conf to enable the options you want working, and set your chroot directory to whatever you want)

This approach needs to be cleaned up, since I still don’t know what library files I need and which files I don’t.  I am sure that, as is, there are a few security bugs.  Probably will whip up a script to test it out tomorrow.

If you follow no other blog, follow Neojaponisme.

A statistical fluke among Tokyo gaijin blogs as it is well-researched and a pleasure to read.

Actually, I will take back the “pleasure to read” part, as it can be disturbing to truly understand how a machine works.  It reminds me of how I felt while studying Genetics; like I was on the verge of understanding many great truths, and simultaneously fighting the urge to run away screaming because of how it unraveled one’s pride in being human.

Headless Ubuntu

Who could have known that it was so hard to switch resolutions on an Ubuntu machine?

Downgraded back to 10.04 last week for my home server; life is too short to get caught up in learning a tablet OS for a server.

The outside perspective

I sat down with “Take”, a fellow IT drone in Tokyo, a few weeks back. We were talking about how things were going for him, and it wasn’t pretty. A tough work situation, a second child on the way, and no way out made him quite a pessimist. “Sempai, this (situation) doesn’t make sense to me..” he murmured in a dejected voice. Needless to say, I shared the sentiment. He was an excellent programmer with a decent background in search engines and C++; where had things gone wrong? My current intuition is that his ideas about normality were pushed to extremes by his coworkers, leaving him with an almost comical misunderstanding of the value proposition he presented.

While we chatted, he mentioned the odd work-life balance equation he had been forced into; better termed a work-sleep balance, he faced constant overtime, low pay, and no time to spend with his family. While I insisted that his skills were valuable to the right people in Japan, he had met me believing his skills were only worth what he was being paid – a mere 2000$/month + rent in some rice paddy in Saitama. This was a fair amount to him; his small circle of friends (mostly otaku and high school grads) generally made less and lived like him (in company furnished housing). Within this skewed framework, he could not imagine how underpaid he was, much less how to improve his position. Then it was too late and he dug me out of his old phone book.

I actually know Take through his wife, a friend of mine when I arrived about 4 years ago. She knew me while I was working 14 hour days for a shady travel startup. At that point, all things being equal, I was living the same life as Take. Where things differed was that I was a bit more extraverted. I met people off of Mixi and Craigslist, I attended IT gatherings (both gaijin and japanese-focused). I also made it a point to ask questions about lifestyle, from long term survivors of the Tokyo lifestyle. In short, I tried to keep my finger on the real pulse of the situation, not an artificial creation that my boss fed me.

I quit my job and endured a lot, because the work wasn’t challenging or compelling (long term) and the money wasn’t enough to ignore the first two. My decision to do so (which i did regret quite a few times) only paid off long term. Take kept on working at the same company, being blessed with two children and cursed with no idea how to provide for them.

In the end I told Take that I would try and help him find another job ( I strongly recommend him to anyone reading this who wants an enthusiastic, stable worker). I also told him to start talking to other people – getting an outside perspective early and often. It might have cost him an “year in the desert” as well, but better that than being locked into a fake context that deprived him of a sense of self worth and action.