Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been advised by a sysadmin guy I know, to run Apache in a chroot jail, for increased security.

I have the following questions:

  1. Is this advisable (i.e. are there any 'gotcha's that I need to be aware of) ?
  2. Does running Apache in a chroot jail affect its ability issues like performance and scalability?

He also advised that I run my databases (mySQL and PostgreSQL), in separate chroot jails.

Is this something that is often done in production systems


Forgot to say, Server is running on Ubuntu 8.04 LTS

share|improve this question
You mention jails: are you on one of the *BSD's? If not, and you're on Linux, SELinux in enforcing mode will probably take care of all your security problems quite well. – wzzrd Jun 3 '10 at 10:41
up vote 5 down vote accepted

Chrooting is a good security measure, it limits the possibilities to compromise the system in case of a successfull exploit but there are also ways in some case to evade from a chroot, so it is not a definitive way to protect the system.

I'm not aware of any disavantage regarding performance and scalability. Concerning database access, it is generaly done with a link to the socket inside the chroot this way you don't have to open any networking port for database connectivity.

EDIT: below is a sample for mysql access taken from an OpenBSD rc.local (OpenBSD chrooted httpd)

if [ X"${mysql_server_flags-NO}" != X"NO" -a -x /usr/local/bin/mysqld_safe ]; then
        rm -R /var/www/var/run/mysql
        mkdir -p /var/www/var/run/mysql
        chown _mysql:_mysql   /var/www/var/run/mysql
        echo -n 'MySQL server: '; /usr/local/bin/mysqld_safe --user=_mysql ${mysql_server_flags} &
        sleep 10
        ln -f /var/run/mysql/mysql.sock /var/www/var/run/mysql/mysql.sock

Hope this helps.

share|improve this answer
+1 for good, straight answer. could you please elaborate some more (i.e. explain) what you mean by 'link to the socket inside the chroot'. can you provide an example? – user35402 Jun 3 '10 at 8:39
Edited my answer. – Maxwell Jun 3 '10 at 8:58
I heartily second the notion of running all DMZ apps in chroot jails. However, the DB backend is typically not in the DMZ, but on an internal network. – mpez0 Jun 3 '10 at 11:09
thanks for the snippet. much obliged! – user35402 Jun 3 '10 at 11:39

I have two programs, one of them is apache httpd, communicating each other via unix domain socket. I have switched them to run under chroot, and then %10 performance loss. It depends on the running applications I think.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.