Securing Linux Users

Question

I would like to know what is best solution for securing linux user account on application and database server (JBoss, Tomcat, mysql database).Lets asume i have user jboss for running JBossm and user mysql for database.I use RHELL 5.1, Suse 11 and solaris.What i want to do is basically create a sandbox for each user, so if user jboss will be broken, no data will be corrupted and so on ..

I know i can use SELinux, but i cant find any tutorial for RHEL, that explains restricting user rights for user.

I also know that chroot jail might be the solution, but i am not sure if JBoss application server can run in chroot jail and how to configure it.

The solution, that i am able to use is explicitly restrict acces for each user to every file on filesystem except files dedicated to him (Not nice, i know)

Answer 1

The solution you proposed:

Restrict access for each user to every file on filesystem except files dedicated to him

is the same idea of chroot. The chroot jail prevents the process from accessing system files except the files inside its new root.

Answer 2

Most processes should work perfectly well inside chroot, as it should be invisible to them - ie they only 'see' the chroot'ed environment as their root environment.