View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0002357 | unreal | ircd | public | 2005-02-20 07:13 | 2005-02-20 14:58 |
| Reporter | Beastie | Assigned To | |||
| Priority | normal | Severity | feature | Reproducibility | N/A |
| Status | closed | Resolution | open | ||
| Product Version | 3.2.3 | ||||
| Summary | 0002357: Advanced security features | ||||
| Description | It would be nice, if UnrealIRCd had command line or configuration options for chrooting and switching the user that owns the running process. Since nobody uses the old-fashoined standard ports: 194, 529, 994; Unreal should not run as root. As for me, I run it as an unprivileged user, called ircd. But in this case the ircd user should have a home directory and a shell, if it don't have, the "su ircd -c './ircd'" command don't let me to start ircd, and I get this: "This account is currently not available." A more advanced solution would be implementing such feature to ircd. When the super-user started the ircd, it could changed to the specified user. It might be implented with unrealircd.conf directives or it might with command line arguments as well. And if an unprivileged user started the ircd, it could run as the unprivileged user. And what about chrooting? Most of the network daemons supports it, imho. It could be also implemented with config directives or with command line arguments. I prefer some kinda command line argument solution, because the config directory specifed at compile-time would collide with the chrooted path conventions. Thus, a simple command line would be: /some/path/ircd -u ircd -t /some/path -c /unrealircd.conf where the -u tells ircd what user to use, the -t tells the chroot environment and -c specifis the config file relative to the chroot environment. What do You think of this? | ||||
| 3rd party modules | |||||
|
|
include/config.h: CHROOTDIR IRC_UID IRC_GID |
|
|
Actually I think this can be closed. Because I'm not in the mood to also make it a cmdline option, besides cmdline options are even disabled by default it wouldn't make much sense... since you would have to change include/config.h to allow cmdline options and thus you could just change CHROOTDIR/IRC_UID/IRC_GID too. |
