Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using lighttpd and php-fpm.

The .php script are processed with with the correct user permission, I see the result on my browser. At the moment all run correctly if i comment chroot= option on PFM conf file. if i add it, I always get 404 not found error.

My document root (on the lighttpd conf file) is: /home/lighttpd/vhosts/website/web

How can I use the chroot parameter? What path do i have to use?

Thank you!

share|improve this question

1 Answer 1

Remember that any time you are using chroot, your chroot'd environment must contain everything you need. In this case, you need php.exe, php.ini, and all your .php scripts, just for starters. If your web application needs to write to certain directories (e.g. /tmp), that has to be inside your chroot as well.

Remember that chroot is literally "change root", as in change the root of your file system. So if you want to chroot php-fpm to e.g. /home/lighttpd/, then if it has to write to /tmp that is actually /home/lighttpd/tmp, so make sure that exists. If you're looking for /etc/php/php.ini, that's similarly /home/lighttpd/etc/php/php.ini -- essentially the leading '/' on any file path for a chroot'd application is replace with the chroot path.

This makes setting up chroot'd environment rather tricky, as you have to create essentially a mirror of the parts of your root filesystem that will be needed within your chroot path. This also means you have to know everything that your chroot'd environment needs, too.

My recommendation is to not bother with chroot at all. It's a very thin layer of security at best, making the effort required to make it work almost worthless, and in all honesty I think you're better served by making sure php-fpm is running under the proper user context (i.e. a restricted user, not root) and that you use proper file system permissions to give that user only the minimum necessary privileges on your system. That includes making sure that that user can't log in to an interactive shell at all (delete the user's password, and set their shell to /bin/false or /bin/nologin), and has no sudo privileges at all (unless absolutely necessary, and then only grant sudo access to the particular commands it needs).

share|improve this answer
    
Thank you! Yes the user are created with /sbin/nologin. How can i set no sudo privileges? THank you really much! –  Damiano Apr 28 '11 at 16:54
    
@Damiano By default a newly-created user has no sudo privileges. I don't know what flavor of Linux you're on, but most have a group (e.g. wheel, admin) that by default has sudo; make sure the user is not in that group. Use the command visudo to read the sudoers file and make sure neither this user nor any of its group are in there. –  Kromey Apr 28 '11 at 17:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.