Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am creating a production server that will run nginx with php-fpm. I want to have a good mix between securing the server, and still having good quick workflow.

Now one thing that always secures the system is chrooting. Now I have read a lot about this, and chrooting nginx is pretty complicated.

It is said that a good way is using the chroot function that php-fpm has build in. I read several guides, that explain how to set this up, but I haven't read about the implications this brings. I even read that there are none.

Well, the first problem I got was something time related. Solution was to copy /etc/localtime and the folder /usr/share/zoneinfo into the chroot directory.

NONE of the guides tell you this, and it is the first error you notice.

Now I am having trouble with file_get_contents, I get the following error:

failed to open stream: php_network_getaddresses: getaddrinfo failed: Name or service not known

I guess the solution will be to add more files into the chroot. I really don't want to do this for every website I develop.

Question

Now is this the case with chrooting, even in php-fpm, or am I doing something wrong. Is there something I have to enable to get everything working, or should I move everything into the directory.

share|improve this question
    
This article has a good list of files to get you started. Also, you can hard link (instead of copying) files to your chroot jail (if it is on the same volume). You may consider making a skeleton directory for future use, as every site you create needs the same basic files. Finally, you may wish to look into 'Jailkit' as it provides some helpful utilities for creating a basic chroot setup. –  cyberx86 Dec 29 '11 at 2:59
    
Thanks again for the help. I read trough the article, and I decided to skip the chrooting. I will have a openbasedir in place, and will make sure the system is sealed with user accounts and permissions. And for some special apps I will create some chroots, but not for every project. –  Saif Bechan Dec 29 '11 at 10:55

2 Answers 2

up vote 2 down vote accepted

Yes, you'll need a basic functioning filesystem within the chroot directory. And no, you shouldn't move (or link) everything - that'll pretty well defeat the entire purpose of chrooting.

Essentially, the resources that need to be present within the chroot are the ones that the server will need to access during runtime - any dynamically loaded libraries, log directories, and support structures needed for anything the server's doing.

In this case, you're missing basic name resolution configuration - /etc/resolv.conf, /etc/nsswitch.conf, and nss/dns/resolv related stuff from /lib would be a good start.

share|improve this answer
    
Ok that sounds like a lot of work. So if I understand it correctly, if I have 20 chrooted sites that need the function file_get_contents, I have to put the files /etc/resolv.conf and other you mentioned into all of the directories? –  Saif Bechan Dec 28 '11 at 22:14
    
Yes, it is indeed a lot of work. And since you'd be running a different chroot for each site, you couldn't use the same web server process on each, so each site would have to be running on a different port (or, more likely, on a different IP address). –  Shane Madden Dec 29 '11 at 0:32
    
Thanks for the advice, I know what to do now. I decided to lock certain small projects just with user accounts and permissions. –  Saif Bechan Dec 29 '11 at 10:56

Copying resolving-libs and /etc-files isn't really necessary, if you can run nscd on your server.

The basic idea is to bind-mount nscd's Unix domain socket (usually /var/run/nscd/socket) into the chroot. (e)glibc will try contacting it for resolving user names, hostnames etc. Only if nscd isn't running, (e)glibc resorts to resolving things by itself.

More details about this and other things you may need to fix when running PHP in a chroot can be found in my blog post:

share|improve this answer
1  
Please give a summary, the link might break (or somebody don't want to follow it) –  vonbrand Apr 30 '13 at 10:58
    
Sure, there you go! –  schieferstapel May 4 '13 at 13:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.