3

I am creating a production server that will run nginx with php-fpm. I want to have a good mix between securing the server, and still having good quick workflow.

Now one thing that always secures the system is chrooting. Now I have read a lot about this, and chrooting nginx is pretty complicated.

It is said that a good way is using the chroot function that php-fpm has build in. I read several guides, that explain how to set this up, but I haven't read about the implications this brings. I even read that there are none.

Well, the first problem I got was something time related. Solution was to copy /etc/localtime and the folder /usr/share/zoneinfo into the chroot directory.

NONE of the guides tell you this, and it is the first error you notice.

Now I am having trouble with file_get_contents, I get the following error:

failed to open stream: php_network_getaddresses: getaddrinfo failed: Name or service not known

I guess the solution will be to add more files into the chroot. I really don't want to do this for every website I develop.

Question

Now is this the case with chrooting, even in php-fpm, or am I doing something wrong. Is there something I have to enable to get everything working, or should I move everything into the directory.

2
  • This article has a good list of files to get you started. Also, you can hard link (instead of copying) files to your chroot jail (if it is on the same volume). You may consider making a skeleton directory for future use, as every site you create needs the same basic files. Finally, you may wish to look into 'Jailkit' as it provides some helpful utilities for creating a basic chroot setup.
    – cyberx86
    Dec 29, 2011 at 2:59
  • Thanks again for the help. I read trough the article, and I decided to skip the chrooting. I will have a openbasedir in place, and will make sure the system is sealed with user accounts and permissions. And for some special apps I will create some chroots, but not for every project. Dec 29, 2011 at 10:55

2 Answers 2

4

Yes, you'll need a basic functioning filesystem within the chroot directory. And no, you shouldn't move (or link) everything - that'll pretty well defeat the entire purpose of chrooting.

Essentially, the resources that need to be present within the chroot are the ones that the server will need to access during runtime - any dynamically loaded libraries, log directories, and support structures needed for anything the server's doing.

In this case, you're missing basic name resolution configuration - /etc/resolv.conf, /etc/nsswitch.conf, and nss/dns/resolv related stuff from /lib would be a good start.

3
  • Ok that sounds like a lot of work. So if I understand it correctly, if I have 20 chrooted sites that need the function file_get_contents, I have to put the files /etc/resolv.conf and other you mentioned into all of the directories? Dec 28, 2011 at 22:14
  • Yes, it is indeed a lot of work. And since you'd be running a different chroot for each site, you couldn't use the same web server process on each, so each site would have to be running on a different port (or, more likely, on a different IP address). Dec 29, 2011 at 0:32
  • Thanks for the advice, I know what to do now. I decided to lock certain small projects just with user accounts and permissions. Dec 29, 2011 at 10:56
1

Copying resolving-libs and /etc-files isn't really necessary, if you can run nscd on your server.

The basic idea is to bind-mount nscd's Unix domain socket (usually /var/run/nscd/socket) into the chroot. (e)glibc will try contacting it for resolving user names, hostnames etc. Only if nscd isn't running, (e)glibc resorts to resolving things by itself.

More details about this and other things you may need to fix when running PHP in a chroot can be found in my blog post:

2
  • 1
    Please give a summary, the link might break (or somebody don't want to follow it)
    – vonbrand
    Apr 30, 2013 at 10:58
  • Sure, there you go! May 4, 2013 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .