Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been advised by a sysadmin guy I know, to run Apache in a chroot jail, for increased security.

I have the following questions:

  1. Is this advisable (i.e. are there any 'gotcha's that I need to be aware of) ?
  2. Does running Apache in a chroot jail affect its ability issues like performance and scalability?

He also advised that I run my databases (mySQL and PostgreSQL), in separate chroot jails.

Is this something that is often done in production systems

[Edit]

Forgot to say, Server is running on Ubuntu 8.04 LTS

share|improve this question
    
You mention jails: are you on one of the *BSD's? If not, and you're on Linux, SELinux in enforcing mode will probably take care of all your security problems quite well. –  wzzrd Jun 3 '10 at 10:41

2 Answers 2

up vote 5 down vote accepted

Chrooting is a good security measure, it limits the possibilities to compromise the system in case of a successfull exploit but there are also ways in some case to evade from a chroot, so it is not a definitive way to protect the system.

I'm not aware of any disavantage regarding performance and scalability. Concerning database access, it is generaly done with a link to the socket inside the chroot this way you don't have to open any networking port for database connectivity.

EDIT: below is a sample for mysql access taken from an OpenBSD rc.local (OpenBSD chrooted httpd)

if [ X"${mysql_server_flags-NO}" != X"NO" -a -x /usr/local/bin/mysqld_safe ]; then
        rm -R /var/www/var/run/mysql
        mkdir -p /var/www/var/run/mysql
        chown _mysql:_mysql   /var/www/var/run/mysql
        echo -n 'MySQL server: '; /usr/local/bin/mysqld_safe --user=_mysql ${mysql_server_flags} &
        sleep 10
        ln -f /var/run/mysql/mysql.sock /var/www/var/run/mysql/mysql.sock
fi

Hope this helps.

share|improve this answer
    
+1 for good, straight answer. could you please elaborate some more (i.e. explain) what you mean by 'link to the socket inside the chroot'. can you provide an example? –  user35402 Jun 3 '10 at 8:39
    
Edited my answer. –  Maxwell Jun 3 '10 at 8:58
    
I heartily second the notion of running all DMZ apps in chroot jails. However, the DB backend is typically not in the DMZ, but on an internal network. –  mpez0 Jun 3 '10 at 11:09
    
thanks for the snippet. much obliged! –  user35402 Jun 3 '10 at 11:39

I have two programs running under chroot. They are communicate each other via unix domain socket and one of them is apache httpd. I have %10 performance lost.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.