Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a machine with lighttpd and evhost setup. All the evhost contain various php apps like wordpress, drupal etc. If one of the php apps gets compromised the attacker will have access to all the php apps in evhost root. Is it possible to close each php app in a 'kind of chroot' and still enable sftp access to all evhosts (that is not to change their file permissions/set them separate owners)? The less effort the better, plus I don't want any solutions that involve restarting lighttpd after adding new php-app/vhost. If it's not possible - maybe there are some options that would enchance security a bit?

share|improve this question
add comment

2 Answers

spawn-fcgi helps you to run the PHP interpreter in a chroot environment (and start it under another UID/GID). Examples for this can be found in the spawn-fcgi respectively the lighttpd wiki. With this method, however, you need to restart/reload lighttpd every time you add a new virtual host (or more precisely: the PHP configuration part of a virtual host).

share|improve this answer
add comment

This is definitely not an elegant solution, but you could possibly run a bunch of lighttpd instances, each one chrooted and then put them all behind a reverse proxy that routes the traffic appropriately.

At the very least, you could isolate some of the sites so that if one lighttpd instance is compromised, it only affects some vhosts and not the rest of them. So, assuming that you have 3 instances running, you can for example, split the vhosts among the three instances.

In fact, you may even want to consider using a mixture of web servers so that vulnerabilities that affect one may still be stopped by another.

Just something to consider, perhaps.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.