3

Backstory:

I am working on setting up a MineCraft server and want to allow admins to have ssh access to the MineCraft server console and appropriate mc server files, but not the whole system. The console provided by the minecraft server is only available to the user that launched the process. In addition, the admins will need terminal access to some basic cli tools such as wget, cp, mv, rm, and a text editor.

Plan:

  • I have already setup the ssh aspect of things, requiring pre-shared keys and whatnot.
  • Setup a jailed environment in which all user activity will be contained.
  • Setup user accounts.
    - The first user account will be the minecraft user. The minecraft user will start the MC server in a multiuser screen session and allow the other admins to attach to it.
    - Subsequent users should have their own /home directory for normal usage.
  • Setup acl for the appropriate files to allow each user to edit the mc server files.

No one will be doing system updates, nor will anyone be installing any programs, so I'll be the only user with sudo.

The Issues:

I don't want the ssh users to have access to the whole system. Users will still need to use wget or curl to update the mc server files. I have no experience setting up a chroot environment and have found several tools to aid in this process. Jailkit seems to be the most robust, but it's not in the standard repos.

The Questions:

  1. Is chroot the right tool for this use case, or is there something more appropriate for the job?
  2. Should there be a chroot environment for each user, or one chroot environment for all users?
  3. Should chroot be setup by hand, or should I use one of the tools available?
  4. How will system updates effect a chroot environment?
  5. Which chroot tool is the most newb friendly? Which chroot tool is the most robust?
  6. Would a VM be a better solution overall?
Anthony
  • 1,086

2 Answers2

1

I won't answer point by point as I don't know all the answers, but I will give you these pointers:

  • A chroot isn't terribly difficult to break out of. A VM is somewhat harder.
  • A VM is much easier to set up and manage as it is a full OS.
  • A chroot can have a smaller footprint as it's not necessarily a full OS.
  • In either case, the guest environment will not be updated when you run updates on the host. You'll have to enter the chroot or VM and update it manually.
  • A VM has a feature which may be good or bad for you: You typically have to provision a fixed amount of memory for it. Minecraft can be very memory hungry, so you might run out with a VM. On the other hand, a VM would be an easy way to put a hard limit on the resources it can use.
  • Neither a VM nor a chroot will place any intrinsic limits on what users can do over the network. Only a firewall can do that.
Alistair Buxton
  • 6,852
1

Using a chroot jail is a false sense of security for the most part. It keeps honest users honest. If you do not trust the users to log into the machine, you should give them a different machine, a VM.

For network security, attach the Minecraft machine to a different zone on your firewall with very restrictive rules. If Minecraft is running on the firewall machine, the only safe solution is to use VMs running on that machine.

le3th4x0rbot
  • 845