Hits :
7414
Chrooted DropBear :: HowTo
This tutorial is being written to help you install DropBear to a chroot environment.
It covers the below sections:
* Installation of DropBear
* Setup DropBear
* Setup Chroot Enviroment
* Debug Chrooted DropBear
DropBear
Dropbear is a relatively small SSH 2 server and client.
It is an alternative lightweight program of
openssh[link1] and it is designed for environments with low memory and processor resources, such as embedded systems.
http://matt.ucc.asn.au/dropbear/dropbear.html
top
Installation
Download
wget -c http://matt.ucc.asn.au/dropbear/releases/dropbear-0.52.tar.bz2
Extract
tar jxf dropbear-0.52.tar.bz2
Configuration
In our installation we choose:
/chroot/dropbear as the root path of our chroot environment
And for educational purpose only, we change the default TCP port of ssh to 2222:
cd dropbear-0.52
./configure --prefix=/chroot/dropbear
sed -i 's/22/2222/g' options.h
Compilation
Simple as that:
make
Installation
The default installation process:
make install
top
Keys
The next step is to create dss & rsa keys for dropbear ssh server.
We must create the dropbear's key folder first:
mkdir -pv /chroot/dropbear/etc/dropbear
and then:
/chroot/dropbear/bin/dropbearkey -t dss -f /chroot/dropbear/etc/dropbear/dropbear.dss
/chroot/dropbear/bin/dropbearkey -t rsa -s 4096 -f /chroot/dropbear/etc/dropbear/dropbear.rsa
As you can see, we used the chroot environment path without the need of our distribution path hierarchy.
The DropBear's keys are already installed to our chroot environment at once.
top
Shared Libraries
We now have to check all the necessaries shared libraries that dropbear needs to run inside a chroot environment
ldd /chroot/dropbear/sbin/dropbear
top
Chroot Environment
Structure
cd /chroot/dropbear/
mkdir -pv dev/pts proc etc lib usr/lib var/run var/log
top
Libraries
cp /lib/libutil.so.1 lib/
cp /usr/lib/libz.so.1 usr/lib/
cp /lib/libcrypt.so.1 lib
cp /lib/libc.so.6 lib/
cp /lib/ld-linux.so.2 lib/
top
Extra Libraries
This libraries are mostly for the authentication process.
cp /lib/libnss_dns.so.2 lib/
cp /lib/libnss_files.so.2 lib/
top
Files
Copy necessaries files from root to chroot
cp /etc/localtime etc/
cp /etc/nsswitch.conf etc/
cp /etc/resolv.conf etc/
cp /etc/host.conf etc/
cp /etc/hosts etc/
touch var/log/lastlog
touch var/run/utmp
touch var/log/wtmp
top
Devices
We now must be very careful with the next step of our process.
We have to create all the necessaries devices for dropbear to run
(Remember, we are always on the chroot path – eg. /chroot/dropbear)
mknod dev/urandom c 1 9
chmod 0666 dev/urandom
mknod dev/ptmx c 5 2
chmod 0666 dev/ptmx
mknod dev/tty c 5 0
chmod 0666 dev/tty
top
Users
Of course we need to add users to our chroot dropbear setup.
You can choose to add an existence user or you can create a new one.
I prefer to add an existence user (eg. ebal):
grep ^ebal /etc/passwd > etc/passwd
grep ^ebal /etc/group > etc/group
grep ^ebal /etc/shadow > etc/shadow
mkdir home/ebal
chown ebal.ebal !$
top
Shell
Every user needs a shell!
But we dont need to install bash, we can simple use busybox.
Busybox is a lightweight shell and combines a lot of common unix utils into a small executable binary file.
cp /etc/shells etc/
sed -i 's/bash/sh/' etc/passwd
cd bin
wget -c http://busybox.net/downloads/binaries/1.16.0/busybox-i686
mv busybox-i686 busybox
chmod 0755 busybox
ln -s busybox sh
cd ../
top
Mount Points
This is the most important thing that we (you) have to do properly.
The new environment needs access to terminals (this is necessary for a user to login) and to proc filesystem.
mount -o bind /dev/pts dev/pts/
mount -o bind /proc proc/
top
Run
Finally we are ready to run DropBear from a chroot enviroment:
chroot /chroot/dropbear/ \
/sbin/dropbear \
-b /etc/dropbear/dropbear.banner \
-d /etc/dropbear/dropbear.dss \
-r /etc/dropbear/dropbear.rsa \
-m -w -g
top
Debug
But if something goes wrong, we can always debug the running process with strace:
strace -f chroot /chroot/dropbear/ \
/sbin/dropbear \
-b /etc/dropbear/dropbear.banner \
-d /etc/dropbear/dropbear.dss \
-r /etc/dropbear/dropbear.rsa \
-F -E -m -w -g
top