1

I'm hosting multiple websites on one VPS, and want to chroot each website, eg. /chroot/website1 /chroot/website2

I'm using makejail, which is a highlevel tool, for creating the jails, and copying the libraries and dependencies. Easy peasy.

Each website will need nginx, php and mysql. For php I'm using php5-fpm which actually supports chroot by configuration, however I'm not using this (maybe I should?)

My question is which approach of the following three is the better:

1) Every website will have its own seperated instance of nginx, php and mysql. The downside is, that each webserver + php has to listen to a different port. I also need a "master" nginx web server in front of them, reverse proxying to the chrooted servers behind it. Probably most secure, but also most advanced.

2) I don't make any chroot jails manually. I setup one nginx web server, that proxies php requests to php-fpm, on different ports. I can have multiple php-fpm configurations each with is own chroot'ed folder. This is quite managable - however only php will be chrooted. Not the actual webserver. Is this secure enough. Also, I tried this option out, and it seems I will need to use TCP instead of sockets for connecting to MySQL.

3) You tell me ;)

I'm quite new to chroot jailing, so please correct me if I'm wrong in my assumptions. I've been reading all the tutorials I could find, however, I find the market for chroot guides very scarce. Any help or inputs much appreciated!

1 Answer 1

1

I ended up using option number 2. If I use TCP (127.0.0.1) instead of sockets (localhost), most things work out of the box.

Somethings has to be taken care of: sendmail and external services. For sendmail you can use mini_sendmail. Pretty easy to setup if you use makejail (Debian/Ubuntu package) and follow this tutorial: http://www.cyberciti.biz/tips/howto-setup-sendmail-php-mail-chrooted-apache-lighttpd.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .