2

I recently created a MineCraft server in Fedora 23, and faced with problem "What if bad guys want to find really important files in my computer? I have to protect my files!"

My jar is in /home/ directory. But I afraid if i move it to other directory bad guys will have access to my files because all programs have access to all directories in my user at the beginning.

I think, that I must use chroot. But the main problem is: I DON'T KNOW HOW.

  • 1
    My personal recommendation is to use docker. There are plenty of minecraft images available, with instructions on how to use them. If you have to ask the question about how to use chroot, docker will be much easier to work with, and more secure. – Patrick Jul 5 '16 at 12:06
2

Patrick's suggestion of docker is good. Any other virtualisation method would work well too (e.g. VirtualBox or kvm).

Another option is to create another user (e.g. minecraft) on your system just for running minecraft server. Give it it's own group (e.g. minecraft) and make sure all minecraft files have RW access for group, then add your own user to the minecraft group so your user has full read + write access to minecraft files.

You can also set up permissions on all minecraft files and directories so that the minecraft user doesn't have write access to most of its own files (only to the files that minecraft absolutely must be able to write). This would require that the minecraft user NOT be a member of the minecraft group (maybe have nobody or nogroup as its primary gid).

Anyone who compromises the minecraft server will have access only to minecraft-owned files, and those that are read or write by everyone. - make sure your files don't have such lax permissions.

  • Setting the user's shell to a restricted shell only affects what happens if the credentials to the minecraft account are compromised, not if a process running as minecraft is compromised. If the attacker can run code in the server process, they can execve anything they want, subject to permissions. – Gilles Jul 5 '16 at 23:32
  • Without chroot, the security measures you describe aren't enough to prevent an attacker who compromises the minecraft account from reading all publicly-readable files on the machine, which is likely to include files that are meant to be private. – Gilles Jul 5 '16 at 23:33
  • which is precisely why i mentioned that fact and said "make sure your files don't have such lax permissions" – cas Jul 6 '16 at 0:24
  • and yes, this is far from comprehensive or perfectly secure - nothing's perfectly secure. It is, however, adequate for the task and reasonably easy to set up. It's essentially the standard advice for all services (like httpd, ftpd, dns, smtp, etc) - run it with its own UID and GID. – cas Jul 6 '16 at 0:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.