Chrooted DropBear :: HowTo
This tutorial is being written to help you install DropBear to a chroot environment.
It covers the below sections:
* Installation of DropBear
* Setup DropBear
* Setup Chroot Enviroment
* Debug Chrooted DropBear
Contents
DropBear
Dropbear is a relatively small SSH 2 server and client.
It is an alternative lightweight program of openssh and it is designed for environments with low memory and processor resources, such as embedded systems.
http://matt.ucc.asn.au/dropbear/dropbear.html
Installation
Download
wget -c http://matt.ucc.asn.au/dropbear/releases/dropbear-0.52.tar.bz2
Extract
tar jxf dropbear-0.52.tar.bz2
Configuration
In our installation we choose: /chroot/dropbear as the root path of our chroot environment
And for educational purpose only, we change the default TCP port of ssh to 2222:
cd dropbear-0.52 ./configure --prefix=/chroot/dropbear sed -i 's/22/2222/g' options.h
Compilation
Simple as that:
make
Installation
The default installation process:
make install
Keys
The next step is to create dss & rsa keys for dropbear ssh server.
We must create the dropbear's key folder first:
mkdir -pv /chroot/dropbear/etc/dropbear
and then:
/chroot/dropbear/bin/dropbearkey -t dss -f /chroot/dropbear/etc/dropbear/dropbear.dss /chroot/dropbear/bin/dropbearkey -t rsa -s 4096 -f /chroot/dropbear/etc/dropbear/dropbear.rsa
As you can see, we used the chroot environment path without the need of our distribution path hierarchy.
The DropBear's keys are already installed to our chroot environment at once.
Shared Libraries
We now have to check all the necessaries shared libraries that dropbear needs to run inside a chroot environment
ldd /chroot/dropbear/sbin/dropbear
Chroot Environment
Structure
cd /chroot/dropbear/ mkdir -pv dev/pts proc etc lib usr/lib var/run var/log
Libraries
cp /lib/libutil.so.1 lib/ cp /usr/lib/libz.so.1 usr/lib/ cp /lib/libcrypt.so.1 lib cp /lib/libc.so.6 lib/ cp /lib/ld-linux.so.2 lib/
Extra Libraries
This libraries are mostly for the authentication process.
cp /lib/libnss_dns.so.2 lib/ cp /lib/libnss_files.so.2 lib/
Files
Copy necessaries files from root to chroot
cp /etc/localtime etc/ cp /etc/nsswitch.conf etc/ cp /etc/resolv.conf etc/ cp /etc/host.conf etc/ cp /etc/hosts etc/ touch var/log/lastlog touch var/run/utmp touch var/log/wtmp
Devices
We now must be very careful with the next step of our process.
We have to create all the necessaries devices for dropbear to run
(Remember, we are always on the chroot path – eg. /chroot/dropbear)
mknod dev/urandom c 1 9 chmod 0666 dev/urandom mknod dev/ptmx c 5 2 chmod 0666 dev/ptmx mknod dev/tty c 5 0 chmod 0666 dev/tty
Users
Of course we need to add users to our chroot dropbear setup.
You can choose to add an existence user or you can create a new one.
I prefer to add an existence user (eg. ebal):
grep ^ebal /etc/passwd > etc/passwd grep ^ebal /etc/group > etc/group grep ^ebal /etc/shadow > etc/shadow mkdir home/ebal chown ebal.ebal !$
Shell
Every user needs a shell!
But we dont need to install bash, we can simple use busybox.
Busybox is a lightweight shell and combines a lot of common unix utils into a small executable binary file.
cp /etc/shells etc/ sed -i 's/bash/sh/' etc/passwd cd bin wget -c http://busybox.net/downloads/binaries/1.16.0/busybox-i686 mv busybox-i686 busybox chmod 0755 busybox ln -s busybox sh cd ../
Mount Points
This is the most important thing that we (you) have to do properly.
The new environment needs access to terminals (this is necessary for a user to login) and to proc filesystem.
mount -o bind /dev/pts dev/pts/ mount -o bind /proc proc/
Run
Finally we are ready to run DropBear from a chroot enviroment:
chroot /chroot/dropbear/ \ /sbin/dropbear \ -b /etc/dropbear/dropbear.banner \ -d /etc/dropbear/dropbear.dss \ -r /etc/dropbear/dropbear.rsa \ -m -w -g
Debug
But if something goes wrong, we can always debug the running process with strace:
strace -f chroot /chroot/dropbear/ \ /sbin/dropbear \ -b /etc/dropbear/dropbear.banner \ -d /etc/dropbear/dropbear.dss \ -r /etc/dropbear/dropbear.rsa \ -F -E -m -w -g