3

So my goal on this is to give each user their own "root" by basically making a loop drive with a copy of core files. I know there is stuff like jail shell, and all that fun stuff that makes it a bit easier, BUT you are still accessing the root files of that system and a crafty bastard can tinker enough to drop out of jail.

My theory is to upon user creation a loop drive is spun up with a copy of root, then when a user logs in, something, maybe a chroot is performed, and it pops them in their bubble. I know user permissions and what not keep people honest, but I essentially don't want that person to know that there is anyone else on that device no matter where they look, nothing but their content will show, and if somehow they ran a command and destroyed their root env, it won't touch the actual machine, only burst their bubble. I know we have came a long way with snaps, and other sandboxing tools to keep stuff from touching other stuff, but nothing I have seen on keeping users in their own user environment.

I am throwing around Ideas, and can't think, would that be a docker scenario, A virt machine, where it just pops in upon login, or if it is actually doable with tweaks to the addusr and login parameters.

My theory.

Like Virt machines, there is a "root user" (let's call him bob) that manages the user accounts, bob can add, delete, modify what not and also manage the machines software and what not.

bob then wants to add sally to the machine, he does the normal adduser, the add user then spins up a a file (dd if=/dev/zero of=/home/sal_drive bs=1000M count=60) spins up a loop device, adds it to fdisk, and then copies some core files in it.

(now this is where I get tripped up) sally is now a user, her home is set to /dev/loop(sally)/home (if that is the proper syntax. OR would that just be left /home/sally and a script would just drop her on the new drive with the environment set?)

sally then is at the login page, punches her login info, and is then dropped in her bubble, with her root and home files.

So the question, Is this doable with just making a few tweaks in the user env in adduser and the login script, and when the user logs in, it chroots to their environment, and Chroots back upon logout. OR would I have to create a virtual instance, and then they login that way. for example, host machine is charles.local, the login page is then loaded to login.charles.local then sally would login to sally.charles.local....

closed as unclear what you're asking by Rui F Ribeiro, msp9011, filbranden, andcoz, countermode Sep 5 '18 at 9:24

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Try to ask a narrower question, such as "How can I restrict a user to a chroot jail?" or "How can I have users log in to a container?" or "Make user sessions live in a private mount namespace", etc. Asking for something more specific is more likely to find someone who can give you pointers of how to achieve what you're trying to do. – filbranden Sep 5 '18 at 6:44
  • 1
    Will do Filipe, My brain was fried, I Wasn't 100% sure how to phrase the question. But thank you for your input :) – Charles Wilson Sep 6 '18 at 17:44
4

Sally is now a user, her home is set to /dev/loop(sally)/home (if that is the proper syntax. ...

Using /dev/loop(sally)/root/home is better, so Sally can type cd .. but once she discovers the permissions or that they are untrue you are discovered. Giving the person a VM permits them a real experience but lookout for Meltdown, Spectre and other TLB hacks or the experience will be your own.

The term you are looking for is honeypot but remember this quotation which has been altered somewhat over the centuries:

Jacques Abbadie (1684): "… ont pû tromper quelques hommes, ou les tromper tous dans certains lieux & en certains tems, mais non pas tous les hommes, dans tous les lieux & dans tous les siécles."

English: One can fool some men, or fool all men in some places and times, but one cannot fool all men in all places and ages.

An expert probably won't be fooled for long and a novice is unlikely to pose as big a threat.

See this one of very many articles on the subject: "Increase your network security: Deploy a honeypot". Without something real there will always be a test it will fail or some means to detect that the environment isn't real. Just give them a VM on an old computer.

  • AHH thank you @Rob That is a great read. But I am not too concerned about hackers per-say. I am looking to have a user, put in a "bubble" if that makes sense, kind of a sandbox for users. so that a user can do what they want, but I don't have to worry about them breaking the computer, or other user environments by accident, not so much intentional hacks. – Charles Wilson Sep 4 '18 at 21:32
  • So for example, I have my computer, I have a group of "students" showing them the in's and outs of using a web-server, so instead of having to spin up a new instance, or worry about resource allocation, the students use the same server, in their own bubble. – Charles Wilson Sep 4 '18 at 21:34
  • So just a quick, pick the smart guys brain. would I set each user to their own machine, such as sally.charles.local then have kerberus handle the login screen instead of initd or can init handle a "remote" login like that. I have been racking google trying to find the right wording to get more info.... but no luck... – Charles Wilson Sep 4 '18 at 23:21
  • If I can just figure out how to get that darn login screen to do what I want.... I "should" be ok to get the vms up. – Charles Wilson Sep 4 '18 at 23:27
  • working on that, that dawned on me after that last comment..... THANK you again rob. I am 100% self taught, and normally I can figure it out, but this one has my head wrapped around a pole! – Charles Wilson Sep 5 '18 at 0:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.