2 m o z i l l a |.| o r g | |
3 _ __ ___ ___ ___| |__ ___ | |_
4 | '_ ` _ \ / _ \_ / '_ \ / _ \| __|
5 | | | | | | (_) / /| |_) | (_) | |_
6 |_| |_| |_|\___/___|_.__/ \___/ \__|
7 ====================================
13 This was written as a living document. I (the author of mozbot 2.0)
14 tried (successfully!) to set up mozbot in a secure environment,
15 chrooted and setuided. This requires much more than a usual
16 installation. So, without further ado, over to myself in the field:
22 I will first be trying to install mozbot 2.0 on a SPARC machine
23 running Sun Solaris. These instructions will probably work for any
24 sane UNIX system. If you use Windows, see the INSTALL.WIN32 file.
28 <ianh:~/mozbot> version
29 Machine hardware: sun4u
32 Hardware: SUNW,Ultra-60
34 I already had Emacs 20.7 installed on the machine, for which I must
35 thank Pavlov. You may, of course, use any editor of your choosing when
36 doing this, although if you use vi or one of its siblings then don't
37 even _think_ about asking me for help. (If you can understand vi I
38 figure mozbot should no problem.)
43 I also had several gigabytes of free disk space. You'll probably need
44 several hundred megabytes to do all of this (including scratch space).
45 (I believe the end result was around 30 megs for everything in the
46 chroot jail directory.)
52 The first thing on my list was to install Perl.
54 <ianh:~/mozbot> mkdir resources
55 <ianh:~/mozbot> cd resources
56 <ianh:~/mozbot/resources> wget http://www.perl.com/CPAN/src/stable.tar.gz
57 <ianh:~/mozbot/resources> tar xvfz stable.tar.gz
59 Next I read the README and INSTALL files:
61 <ianh:~/mozbot/resources> cd perl-5.6.0/
62 <ianh:~/mozbot/resources/perl-5.6.0> emacs-20.7 README INSTALL
64 This told me how to do the next few bits.
66 <ianh:~/mozbot/resources/perl-5.6.0> rm -f config.sh Policy.sh
67 <ianh:~/mozbot/resources/perl-5.6.0> sh Configure -Dprefix=/u/ianh/mozbot
69 By providing a prefix, the default installation directory for a lot of
70 modules I am about to install is automatically set up correctly. So if
71 you don't install Perl yourself, remember to take this into account!
73 Note: I didn't change any of the build options, so threads, debugging
74 and the like are all disabled (or at their defaults). The only things
75 I changed were that I answered 'n' to the question 'Binary
76 compatibility with Perl 5.005?', which defaulted to 'y', and I told it
77 not to install into '/usr/bin/perl'.
79 <ianh:~/mozbot/resources/perl-5.6.0> make
80 <ianh:~/mozbot/resources/perl-5.6.0> make test
81 <ianh:~/mozbot/resources/perl-5.6.0> make install
82 <ianh:~/mozbot/resources/perl-5.6.0> cd ..
84 At this point I had Perl installed correctly in my mozbot directory.
90 The next thing to install was wget.
92 <ianh:~/mozbot/resources> wget ftp://ftp.gnu.org/pub/gnu/wget/wget-1.6.tar.gz
93 <ianh:~/mozbot/resources> tar xvfz wget-1.6.tar.gz
94 <ianh:~/mozbot/resources> cd wget-1.6
95 <ianh:~/mozbot/resources/wget-1.6> emacs-20.7 README INSTALL
96 <ianh:~/mozbot/resources/wget-1.6> ./configure --prefix=/u/ianh/mozbot
97 <ianh:~/mozbot/resources/wget-1.6> make
98 <ianh:~/mozbot/resources/wget-1.6> make install
99 <ianh:~/mozbot/resources/wget-1.6> cd ..
101 No problems, no difficulties.
107 Now, before going on any further with installing the required modules,
108 I needed to find what those were. Ergo, the next thing to install was
109 mozbot. Presumably you already have the relevant files, or know where
110 to get them, since you are reading a file that comes with the source.
112 <ianh:~/mozbot/resources> wget http://www.damowmow.com/mozilla/mozbot/mozbot.tar.gz
114 There is no configuration, makefile or install script for mozbot,
115 since there is nothing to compile or particularly install. So, I just
116 extracted the mozbot tarball directly inside what would be the root of
117 the file system when I eventually chroot()ed.
119 <ianh:~/mozbot/resources> cd ../..
120 <ianh:~> tar xvfz mozbot/resources/mozbot.tar.gz
122 Like all shell scripts, one thing to change about it is the location
123 of the Perl executable in the shebang.
126 <ianh:~/mozbot> emacs-20.7 mozbot.pl
128 Since I'll be running it from the version of Perl I just installed, I
129 changed the first line to read:
133 Note that this requires me to run mozbot from the mozbot directory. If
134 you've read the README file, you'll know that this is a prerequisite
135 of running mozbot anyway.
141 If you tried running mozbot now, you'd find it was missing
142 Net::IRC. So, guess what I installed next? ;-)
144 <ianh:~/mozbot> cd resources
145 <ianh:~/mozbot/resources> wget http://www.cpan.org/authors/id/FIMM/Net-IRC-0.70.tar.gz
146 <ianh:~/mozbot/resources> tar xvfz Net-IRC-0.70.tar.gz
147 <ianh:~/mozbot/resources> cd Net-IRC-0.70
148 <ianh:~/mozbot/resources/Net-IRC-0.70> emacs-20.7 README
149 <ianh:~/mozbot/resources/Net-IRC-0.70> ../../bin/perl Makefile.PL
150 <ianh:~/mozbot/resources/Net-IRC-0.70> make
151 <ianh:~/mozbot/resources/Net-IRC-0.70> make install
152 <ianh:~/mozbot/resources/Net-IRC-0.70> cd ..
154 It is important to use the Perl we just installed and not any other
155 Perl on the system, otherwise you'll get incorrect prefixes and
156 stuff. (I didn't bother to use the wget I just installed...)
162 Yup, you guessed it, Net::SMTP is next.
164 <ianh:~/mozbot/resources> wget http://www.cpan.org/authors/id/GBARR/libnet-1.0703.tar.gz
165 <ianh:~/mozbot/resources> tar xvfz libnet-1.0703.tar.gz
166 <ianh:~/mozbot/resources> cd libnet-1.0703
167 <ianh:~/mozbot/resources/libnet-1.0703> emacs-20.7 README
168 <ianh:~/mozbot/resources/libnet-1.0703> ../../bin/perl Makefile.PL
170 I answered 'y' to the question 'Do you want to modify/update your
171 configuration (y|n) ? [no]', which was asked because the system
172 had already had libnet installed once.
174 I kept the defaults for all the options though.
176 <ianh:~/mozbot/resources/libnet-1.0703> make
177 <ianh:~/mozbot/resources/libnet-1.0703> make test
178 <ianh:~/mozbot/resources/libnet-1.0703> make install
179 <ianh:~/mozbot/resources/libnet-1.0703> cd ..
181 This also installed Net::FTP, which is required by some of the modules
182 (in particular, the FTP module!).
185 INITIAL CONFIGURATION
186 ---------------------
188 Now I needed to set up the environment for mozbot. The only real thing
189 that needs setting up is the PATH variable. So:
191 <ianh:~/mozbot/resources> cd ..
192 <ianh:~/mozbot> emacs-20.7 run-mozbot-chrooted
194 Here are the contents of my run-mozbot-chrooted script:
196 export PATH=/u/ianh/mozbot/bin
199 It is absolutely imperative that the path not contain '::' or '.'
200 anywhere, as this will be treated as the current directory, which will
201 then result in perl exiting with taint errors.
203 Now we make it executable:
205 <ianh:~/mozbot> chmod +x run-mozbot-chrooted
207 (Note. a sample run-mozbot-chrooted script is shipped with mozbot --
208 it still requires you to follow all these steps though.)
214 At this point, mozbot is runnable... so I ran it!
216 <ianh:~/mozbot> ./run-mozbot-chrooted
218 Note that I'm running it via my script and not directly. If you were
219 not intending to run mozbot in a chroot() jail environment, then
220 './mozbot.pl' would be sufficient.
222 It prompted me for various things, like servers and so on. Then it
223 connected without problems but with no modules set up, as I expected.
225 On IRC, I configured mozbot as I wanted it:
228 mozbot auth admin password
229 newuser Hixie newpass newpass
233 I also played a bit with the configuration variables:
235 vars Admin throttleTime '2.2'
237 This was all very well, but no modules makes mozbot a boring bot, so
238 the next thing was...
244 I shut down mozbot ('shutdown please') and installed the filters
245 required by the 'Filters' BotModule.
247 <ianh:~/mozbot> cd resources
248 <ianh:~/mozbot/resources> wget ftp://ftp.debian.org/pub/mirrors/debian/dists/potato/main/source/games/filters_2.9.tar.gz
249 <ianh:~/mozbot/resources> tar xvfz filters_2.9.tar.gz
250 <ianh:~/mozbot/resources> cd filters
251 <ianh:~/mozbot/resources/filters> emacs-20.7 README
252 <ianh:~/mozbot/resources/filters> make
254 At this point, I edited the Makefile to change /usr/.../ so as to
255 point in the places we used for installing Perl.
257 <ianh:~/mozbot/resources/filters> make install PREFIX=/u/ianh/mozbot
258 <ianh:~/mozbot/resources/filters> cd ..
260 I should point out that this didn't go too well and I had to hack
261 about with the Makefile and my environment and so on, so good luck
262 (admittedly, Pavlov happened to install a new compiler at the same
263 time, and didn't bother to install a license for it, so I had a few
264 more problems than you should, but...).
266 You should also make sure that the shebang lines in the five relevant
267 perl scripts that you should make sure ended up in ~/mozbot/bin
268 actually point to the right perl executable. I had to edit the files
275 In order to insult people, the Rude module needs to Telnet:
277 <ianh:~/mozbot/resources> wget http://www.cpan.org/authors/id/JROGERS/Net-Telnet-3.02.tar.gz
278 <ianh:~/mozbot/resources> tar xvfz Net-Telnet-3.02.tar.gz
279 <ianh:~/mozbot/resources> cd Net-Telnet-3.02
280 <ianh:~/mozbot/resources/Net-Telnet-3.02> emacs-20.7 README
281 <ianh:~/mozbot/resources/Net-Telnet-3.02> ../../bin/perl Makefile.PL
282 <ianh:~/mozbot/resources/Net-Telnet-3.02> make
283 <ianh:~/mozbot/resources/Net-Telnet-3.02> make test
284 <ianh:~/mozbot/resources/Net-Telnet-3.02> make install
285 <ianh:~/mozbot/resources/Net-Telnet-3.02> cd ..
287 That went a lot smoother than the filters installation, let me tell
294 The translation module requires a whole bunch of other modules, mainly
295 due to its dependency on WWW::Babelfish, which requires half of libwww
296 and also IO::String. libwww itself requires another half a dozen
297 modules, namely URI, MIME-Base64, HTML::Parser, libnet (which I
298 installed earlier, thankfully), and Digest::MD5. And HTML-Parser
299 requires HTML-Tagset!
301 I found these dependencies out by browsing CPAN reading README files.
303 <ianh:~/mozbot/resources> lynx http://www.cpan.org/
305 Thankfully, they all installed rather smoothly. Here is the complete
306 list of commands I used to install WWW::Babelfish (starting in the
307 'resources' directory):
309 wget http://www.cpan.org/authors/id/GAAS/MIME-Base64-2.12.tar.gz
310 tar xvfz MIME-Base64-2.12.tar.gz
312 ../../bin/perl Makefile.PL
318 wget http://www.cpan.org/authors/id/GAAS/URI-1.11.tar.gz
319 tar xvfz URI-1.11.tar.gz
321 ../../bin/perl Makefile.PL
327 wget http://www.cpan.org/authors/id/S/SB/SBURKE/HTML-Tagset-3.03.tar.gz
328 tar xvfz HTML-Tagset-3.03.tar.gz
330 ../../bin/perl Makefile.PL
336 wget http://www.cpan.org/authors/id/GAAS/HTML-Parser-3.19_91.tar.gz
337 tar xvfz HTML-Parser-3.19_91.tar.gz
338 cd HTML-Parser-3.1991
339 ../../bin/perl Makefile.PL
345 wget http://www.cpan.org/authors/id/GAAS/Digest-MD5-2.13.tar.gz
346 tar xvfz Digest-MD5-2.13.tar.gz
348 ../../bin/perl Makefile.PL
354 wget http://www.cpan.org/authors/id/GAAS/libwww-perl-5.51.tar.gz
355 tar xvfz libwww-perl-5.51.tar.gz
357 ../../bin/perl Makefile.PL
363 wget http://www.cpan.org/authors/id/GAAS/IO-String-1.01.tar.gz
364 tar xvfz IO-String-1.01.tar.gz
366 ../../bin/perl Makefile.PL
372 wget http://www.cpan.org/authors/id/D/DU/DURIST/WWW-Babelfish-0.09.tar.gz
373 tar xvfz WWW-Babelfish-0.09.tar.gz
374 cd WWW-Babelfish-0.09/
375 ../../bin/perl Makefile.PL
381 Yes, this is surreal. I always knew languages were hard.
387 The last module, the UUID generator, requires a program that you'll
388 find along with mozbot in CVS. You may have this already. If you
389 don't, then here's how I got my copy:
391 <ianh:~/mozbot/resources> export CVSROOT=:pserver:anonymous@cvs-mirror.mozilla.org:/cvsroot
392 <ianh:~/mozbot/resources> cvs login
394 The password is 'anonymous'.
396 <ianh:~/mozbot/resources> cvs checkout mozilla/webtools/mozbot/uuidgen
397 <ianh:~/mozbot/resources> cd mozilla/webtools/mozbot/uuidgen/
398 <ianh:~/mozbot/resources/mozilla/webtools/mozbot/uuidgen> make
399 <ianh:~/mozbot/resources/mozilla/webtools/mozbot/uuidgen> cp uuidgen ../../../../../bin
400 <ianh:~/mozbot/resources/mozilla/webtools/mozbot/uuidgen> cd ../../../../../
402 At this point I think I had all the required programs.
405 MORE THOROUGH CONFIGURATION
406 ---------------------------
408 Now that I'm ready to run mozbot chroot()ed, it is time to make the
409 final preparations. Firts, I moved the resources directory out of the
410 way, since I had finished with it:
412 <ianh:~/mozbot> mv resources ../installed-resources
414 Next I made sure all the rights were set to read-only for people other
417 <ianh:~/mozbot> chmod -R go-w .
419 At this point I wanted to make sure the bot started ok, so I ran the
420 run-mozbot-chrooted script:
422 <ianh:~/mozbot> ./run-mozbot-chrooted
424 That worked. I changed the script to:
427 ./mozbot.pl --chroot /config/default
429 What's this 'config' thing? Well, since we're about to chown() all the
430 files to root and then setuid the script to nobody, the bot wouldn't
431 be able to edit the config file if it was in the same directory as the
432 source -- so I created a new directory with no rights restrictions,
433 and moved the configuration file into it:
435 <ianh:~/mozbot> mkdir config
436 <ianh:~/mozbot> mv mozbot.pl.cfg config/default
437 <ianh:~/mozbot> chmod ugo=rwx config
438 <ianh:~/mozbot> chmod ugo=rw config/default
440 In order to not have to change all the perl scripts, I gave them a
441 fake 'mozbot' directory:
443 <ianh:~/mozbot> mkdir u
444 <ianh:~/mozbot> mkdir u/ianh
445 <ianh:~/mozbot> cd u/ianh
446 <ianh:~/mozbot/u/ianh> ln -s / mozbot
447 <ianh:~/mozbot/u/ianh> cd ../../
449 At this point I ran 'su' to drop down to a root shell. Be careful!
451 I had to copy several library files to a usr/lib directory. To do
452 this, the 'truss' and 'ldd' tools came in very useful. In particular,
453 I used 'truss' to watch what calls mozbot was attempting, and 'ldd' to
454 find what modules dependencies Perl, wget, and the modules had.
456 Credit should be given to Pavlov for actually doing most of this for
457 me... I didn't even know 'ldd' existed until he showed me. ;-)
459 Here is the list of the modules I copied:
462 ld.so.1 libdl.so.1 libgen.so.1 libmp.so.2
463 libresolv.so.1 libsec.so.1 nscd_nischeck nss_files.so.1
464 libc.so.1 libdoor.so.1 libld.so.2 libnsl.so.1
465 libresolv.so.2 libsocket.so.1 nss_compat.so.1 nss_nis.so.1
466 libcrypt_i.so.1 libelf.so.1 liblddbg.so.4 libpthread.so.1
467 librtld.so.1 libthread.so.1 nss_dns.so.1 nss_nisplus.so.1
469 usr/platform/SUNW,Ultra-60:
472 You may not need all of these.
474 I also had to copy /dev/null, /dev/zero, /dev/tcp, /dev/ticotsord and
475 /dev/udp into a new dev/ directory (hint: use 'tar' to copy devices,
476 it won't work if you try to do it with 'cp'). I may not have needed
477 all of these (this was slightly complicated by the fact that on
478 Solaris the /dev devices are symlinks; I used 'tar' to copy the real
479 devices from /devices and renamed them when I extracted the tarball):
482 drwxrwxr-x 2 root other 512 Mar 30 14:34 .
483 drwxr-xr-x 16 root staff 512 Mar 30 15:47 ..
484 crw-rw-r-- 1 root sys 13, 2 Mar 30 14:25 null
485 crw-rw-rw- 1 root sys 11, 42 Jun 6 2000 tcp
486 crw-rw-rw- 1 root sys 105, 1 Jun 6 2000 ticotsord
487 crw-rw-rw- 1 root sys 11, 41 Jun 6 2000 udp
488 crw-rw-r-- 1 root sys 13, 12 Jun 6 2000 zero
490 I had to copy several files from /etc into a new 'etc' directory, in
494 group hosts netconfig nsswitch.conf
495 passwd protocols resolv.conf wgetrc
497 You may wish to sanitize your 'passwd' file. For the nsswitch.conf
498 file you should use the 'nsswitch.dns' file (if you have one) -- make
499 sure the DNS line is 'dns files' and not 'files dns'. (Profuse thanks
500 go to rfm from Sun who helped me with this.)
502 Now I used 'chown' to make every file in /u/ianh/mozbot/ be owned by
503 root, except the config directory. I also edited 'mozbot.pl' to ensure
504 that the correct arguments were passed to 'setuid' and 'setgid' --
505 search for 'setuid' in the source to find the right place.
507 With that all set up, I finally could run the bot safe in the
508 knowledge that it was relatively secure:
510 <root:/u/ianh/mozbot> ./run-mozbot-chrooted
512 I hope this has helped you in some way!!!