I have a FreeBSD server (company's OS of choice). Currently we run several websites on each of the webservers. Websites are in PHP which is run in Apache Module mode. At the Apache is not chrooted so Apache and PHP have access to the whole filesystem.
For my private websites I use a shared hosting service. It seems that the service provider is running a customised Apache version. What is interesting, each website (VirtualHost I presume) on the server is chrooted the to DocumentRoot. How would I go about doing this on my Apache setup?
I have looked at Apache's ChrootDir which is almost good enough for me, but there is either a problem with it handling VirtualHosts or me not being able to set it up properly. Although it seems to run fine - can access VirtualHosts - there seems to be a problem when (re)starting the apache. I get warnings for VirtualHosts DocumentRoot. The config extract:
ChrootDir "/usr/local/www/apache22/data" DocumentRoot "/" <VirtualHost *:80> DocumentRoot "/test-1" ServerName test-1.example.com </VirtualHost> <VirtualHost *:80> DocumentRoot "/test-2" ServerName test-1.example.com </VirtualHost>
And the warnings are:
Warning: DocumentRoot [/test-1] does not exist Warning: DocumentRoot [/test-2] does not exist
Also, there are a lot more problems with SSL enabled. Haven't got round to resolving those yet though.
So, my questions are:
- How to chroot each VirtualHost to its DocumentRoot?
- How to properly chroot Apache's global DocumentRoot to make it work with VirtualHosts and SSL?