Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Prompted from a question about MySQL server security best practices, I've been running through this list (with a few minor alterations) to properly secure my server database server:

http://www.greensql.net/publications/mysql-security-best-practices

On step 10, I'm told to change the root directory for the mysql user using chroot, but very few specifics are provided and I'm not sure where to start. Does anyone know of a good resource for walking me through the steps to properly create a chrooted environment for Ubuntu 10.10?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

In a chroot for MySQL to work you would basically have to recreate a separate Linux distribution.

I put my databases (MySQL and PostreSQL) into OpenVZ containers - it's chroot but more. It provides other features that chroot does not provide: resource control, network isolation, and more. The main upside is that it does everything for me - I just select a template for the container, run vzctl create 101 --ostemplate ubuntu-10.10-x86_64 and I have a container (a working chroot++) ready.

To get the container into production I have to setup a local or public IP address and increase the default resource limits.

To get OpenVZ one has to install and reboot into an OpenVZ patched kernel which is available in a number of major Linux distors but unfortunately OpenVZ has been discontinued as an official Ubuntu package. It is supported in Debian and will be in Debian 6.0.

share|improve this answer
    
Yes. OpenVZ and the newer LXC container-based virtualization technologies are a very nice alternative to chrooting. +1 for "chroot++". –  Steven Monday Dec 29 '10 at 21:01
    
Aha. Thank you very much for the input! –  Calvin Froedge Dec 29 '10 at 21:09
add comment

My guess is that the author of that guide had "Chroot jail" as a bullet point in his outline, but then shrank away from giving the full details when it became clear that getting MySQL to work correctly within a chroot jail is not trivial.

Basically, chroot jailing any daemon involves setting up an environment in which the daemon will find all the filesystem resources it needs inside the jail, and that can include things like /etc/{passwd,group}, /usr/{bin,lib}/, /var/{log,run,lib}/, and so on. Every daemon has different specific needs, so unfortunately, there is no one-size-fits-all guide to chrooting.

If you're really serious about chroot jailing MySQL, I found a Debian/Ubuntu-specific recipe which at least one commenter claims works for versions as recent as Debian Lenny and MySQL 5.

share|improve this answer
    
Ahhhhh = ). Thank you for the help! –  Calvin Froedge Dec 29 '10 at 21:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.