Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently I'm being told that a user has my system 'shelled.' While there hasn't been any unusual activity or errors in Apache error log, etc.. I'd rather be safe than sorry.

So: If I run chroot Apache, will it prevent shell scripts being able to retrieve sensitive info? I.e. being able to do a mysqldump or anything of the sort regardless if the configuration files with the database details are in the apache jail?


share|improve this question
Sorry to be so blunt, but if you have to ask this question, you should not be running a public-facing server yet. – Simon Richter Jun 5 '12 at 8:26
lol 12characters – Tar Jun 5 '12 at 8:57
up vote 1 down vote accepted

Well it would rise the level of security of the Apache instance :) . And as far as I know even with chroot the scripts can still be executed (depending on what other methods you have in place )

Please have a look here (20 quick measures to secure your apache instance ) . You can find more about securing Apache here .

Depending on your environment and on how important / exposed is the apache I would take several measure not only chroot .

share|improve this answer

chrooting will prevent access to most tools (i.e. /bin/ /sbin/ etc.) and devices, but if you are using mysql via a unix socket you will still need to expose that socket in apaches chroot. chrooting won't prevent access to the local TCP port either.

If your goal is to prevent local execution by apache, I suggest using selinux. There are many documents describing this, but I prefer Fedoras apache setup [1] or the more general Centos wiki [2]

[1] [2]

share|improve this answer
In fact, what chroot is preventing is having permanent modifications outside of the new root being made to the system. It does by no means prevent code execution or restricts network connectivity, so given a scenario where a chrooted shell user is able to get to an own version of mysql(dump) alongside with database credentials, he would be able to access the database regardless of the chroot. SELinux is indeed more flexible in this regard, but also significantly more complex to configure. – the-wabbit Jun 5 '12 at 11:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.