Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Backstory:

I am working on setting up a MineCraft server and want to allow admins to have ssh access to the MineCraft server console and appropriate mc server files, but not the whole system. The console provided by the minecraft server is only available to the user that launched the process. In addition, the admins will need terminal access to some basic cli tools such as wget, cp, mv, rm, and a text editor.

Plan:

  • I have already setup the ssh aspect of things, requiring pre-shared keys and whatnot.
  • Setup a jailed environment in which all user activity will be contained.
  • Setup user accounts.
    - The first user account will be the minecraft user. The minecraft user will start the MC server in a multiuser screen session and allow the other admins to attach to it.
    - Subsequent users should have their own /home directory for normal usage.
  • Setup acl for the appropriate files to allow each user to edit the mc server files.

No one will be doing system updates, nor will anyone be installing any programs, so I'll be the only user with sudo.

The Issues:

I don't want the ssh users to have access to the whole system. Users will still need to use wget or curl to update the mc server files. I have no experience setting up a chroot environment and have found several tools to aid in this process. Jailkit seems to be the most robust, but it's not in the standard repos.

The Questions:

  1. Is chroot the right tool for this use case, or is there something more appropriate for the job?
  2. Should there be a chroot environment for each user, or one chroot environment for all users?
  3. Should chroot be setup by hand, or should I use one of the tools available?
  4. How will system updates effect a chroot environment?
  5. Which chroot tool is the most newb friendly? Which chroot tool is the most robust?
  6. Would a VM be a better solution overall?
share|improve this question
    
This is a typical use scenario for chroot. Not sure what the preferred / recommended version is for Ubuntu. What Ubuntu version? –  david6 Oct 20 '12 at 23:40
    
Version? well tbh i'm using debian wheezy. –  Anthony Oct 20 '12 at 23:48
    
This might not be the correct forum for your question .. –  david6 Oct 20 '12 at 23:54
1  
I know this site is ubuntu specific, but the topic is applicable. I've had such positive experiences here that I figured answering these questions here would benefit the community that we all love. :) –  Anthony Oct 21 '12 at 0:00
    
Maybe we could change the focus of this question from my specific use case to something more general. Maybe focus on a simple guide to help users determine if chroot is right for their use case, whatever it might be. –  Anthony Oct 24 '12 at 16:50

2 Answers 2

I won't answer point by point as I don't know all the answers, but I will give you these pointers:

  • A chroot isn't terribly difficult to break out of. A VM is somewhat harder.
  • A VM is much easier to set up and manage as it is a full OS.
  • A chroot can have a smaller footprint as it's not necessarily a full OS.
  • In either case, the guest environment will not be updated when you run updates on the host. You'll have to enter the chroot or VM and update it manually.
  • A VM has a feature which may be good or bad for you: You typically have to provision a fixed amount of memory for it. Minecraft can be very memory hungry, so you might run out with a VM. On the other hand, a VM would be an easy way to put a hard limit on the resources it can use.
  • Neither a VM nor a chroot will place any intrinsic limits on what users can do over the network. Only a firewall can do that.
share|improve this answer
    
Thank you for your response. I did realize that a VM would require its own system maintenance, but didn't realize that a chroot would as well. Would a chroot have a smaller footprint than a VM? –  Anthony Oct 21 '12 at 2:28
    
Yes, because a chroot shares the same filesystem and memory as the main system. The trade off is that it can exhaust both unless you make extra arrangements to prevent it. –  Alistair Buxton Oct 21 '12 at 3:08
    
Also, you don't need a full OS with a chroot, which you do with a VM. However, having those extra OS bits around makes it easier to deal with (eg upgrades). –  Alistair Buxton Oct 21 '12 at 3:15
    
Interesting. I'm actually wondering if either a chroot or a VM is overkill for my use case... –  Anthony Oct 21 '12 at 3:51
    
Perhaps. It depends what kind of abuse you expect from the server admins :) - in either a VM or a chroot, they could install "bad" things, and generally do anything they could do on the main system. It may be easier to clean up after them though, if they are limited. Also note that you can't usually nest VMs, so it's out of the question if you have a cheap VPS; you'd need a dedicated server or a special type of VPS. That limitation does not apply to chroot though. –  Alistair Buxton Oct 21 '12 at 3:57

Using a chroot jail is a false sense of security for the most part. It keeps honest users honest. If you do not trust the users to log into the machine, you should give them a different machine, a VM.

For network security, attach the Minecraft machine to a different zone on your firewall with very restrictive rules. If Minecraft is running on the firewall machine, the only safe solution is to use VMs running on that machine.

share|improve this answer
    
I agree with your comments here. I do have the minecraft server on a separate subnet which is quarantined from the rest of the network. –  Anthony Oct 24 '12 at 16:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.