安装jailkit实现chroot

安装jailkit实现chroot

搭建简易堡垒机 - jailkit chroot

源码包安装jailkit

[root@localhost src]# cd /usr/local/src/
[root@localhost src]# wget https://olivier.sessink.nl/jailkit/jailkit-2.19.tar.bz2
[root@localhost src]# tar -jxvf jailkit-2.19.tar.bz2
[root@localhost src]# cd jailkit-2.19/
[root@localhost jailkit-2.19]# yum install gcc -y
[root@localhost jailkit-2.19]# ./configure
[root@localhost jailkit-2.19]# make
[root@localhost jailkit-2.19]# make install

创建虚拟系统的根目录，初始化命令，会在虚拟系统的根目录下生成一些目录

[root@localhost jailkit-2.19]# mkdir /home/jail
[root@localhost jailkit-2.19]# jk_init -v -j /home/jail/ basicshell
[root@localhost jailkit-2.19]#  jk_init -v -j /home/jail/ editors
[root@localhost jailkit-2.19]#  jk_init -v -j /home/jail/ netutils
[root@localhost jailkit-2.19]# jk_init -v -j /home/jail/ ssh
[root@localhost jailkit-2.19]# cd /home/jail/
[root@localhost jail]# ls
bin  dev  etc  lib64  usr

创建系统用户并设置密码

[root@localhost jail]# useradd aling;echo "aling"|passwd --stdin aling

拷贝虚拟系统的shell文件

[root@localhost jail]# mkdir /home/jail/usr/sbin
[root@localhost jail]# cp /usr/sbin/jk_lsh /home/jail/usr/sbin/jk_lsh

创建虚拟系统用户

[root@localhost jail]# jk_jailuser -m -j /home/jail/ aling

将虚拟用户的shell改为/bin/bash

[root@localhost jail]# sed -ir '/^aling/s@/usr/sbin/jk_lsh@/bin/bash@' /home/jail/etc/passwd

用aling用户登陆(用的命令很少)

在原系统里更改 /etc/ssh/sshd_config 设定只允许密钥登陆，设定防火墙规则，设置允许哪些ip可以登陆

vim /etc/ssh/sshd_config
PasswordAuthentication no

vim /etc/hosts.allow
sshd: 192.168.221.0/24   //允许哪些ip

vim /etc/hosts.deny
sshd: ALL   //除了允许ip之外的ip都拒绝

日志审计

[root@apenglinux-002 ~]# mkdir /usr/local/records
[root@apenglinux-002 ~]# chmod 777 /usr/local/records
[root@apenglinux-002 ~]# chmod +t /usr/local/records

[root@apenglinux-002 ~]# vim + /etc/profile  //在最后追加如下
if [ ! -d  /usr/local/records/${LOGNAME} ]
then
    mkdir -p /usr/local/records/${LOGNAME}
    chmod 300 /usr/local/records/${LOGNAME}
fi
export HISTORY_FILE="/usr/local/records/${LOGNAME}/bash_history"
export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}") #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >>$HISTORY_FILE'

[root@apenglinux-002 ~]# source /etc/profile