0

My setup:

  • In production I'm using one virtual server per one web application shard. Shards are behind load balancer.
  • In backstage we run web application + DB on a single virtual server. The backstage is only protected by auth digest for non tester users. The web application is exposed directly.

The web application is served by Go net.http server. The running code is deployed only by our team. We are not exposing a platform to third party users to run their code.

For both setups there is a dedicated, unprivileged, user which runs this application.

Is it worth to use chroot when running web applications?

Should I use any other security tweaks?

1 Answer 1

1

"Is it worth" depends mostly on your priorities and the type of application that you run on your server.

For example if you run code that has not been put there by yourself, like if you have customers uploading code to your server, it would probably be a good idea to use chroot. Or if you run third party applications that might have security flaws and allow attackers to run code on your server, it might also be better to put it into chroot (I've had such a case with PHPMyAdmin myself). Also if your server is running multiple different applications, it might be better to do chrooting. That way you can make sure that if one of these applications gets hacked, the attacker can't also affect/modify one of the other hosted applications.

Otherwise, if you have nothing else running on this server, nothing outside of the main application can get stolen from it, and you are prepared to simply reinitialize it if it gets hacked, maybe chrooting would be unnecessary.

1
  • Thanks for answer. I'm refining my description based on you answer. Aug 1, 2013 at 14:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .