I'm currently providing web hosting on a shared web hosting VPS environment - that has no chroot. This is obviously a big security concern, although I've made sure that only the owners of files can edit their own stuff.

I'm getting to the point of uneasiness and necessary professionalism that I want to do this thing right. Instead of simply copying files into a chroot environment, I think I want to re-build a new VPS from scratch to get rid of old cruft, make sure I configure the chroots properly, etc...

I'm wondering if its possible to configure yum to update everything in every chroot jail on the server. Chroot jails (and configuring them) are probably one of the things I'm least knowledgeable about in terms of operating web servers.

My initial idea is to do something like this: Have an instance of MySQL running on the root server to handle all databases. Postfix, etc... will obviously also run in the root environment. Then, don't even run apache on the root server, but have separate instances of it in each chroot jail for each user. Jails would also have separate instances of rssh (providing sftp/scp access), but nothing else.

Does this sound reasonable Do you folks have any suggestions as I move forward with this research and build?


The first step is to generate a rpmdb within the chroot by creating /var/lib/rpm within it and using rpm --root /path/to/chroot --initdb. After that you need to install the $distro-release package within it with rpm so that yum has information about the distro whose repos it needs to access. Once you've done that you can use yum --installroot=/path/to/chroot in order to have it operate within that chroot.

  • This is very helpful, thank you. From a security standpoint, since I'm not giving users shell access, is it legitimate to have a single instance of MySQL running? If so, I'm a little confused as to how I can connect each individual instance of Apache running in the jails to the single MySQL instance. Would the loopback address of work? I suppose I'm also going to need to install PHP into each jail. – David W Mar 12 '11 at 16:09
  • All the apps running in the chroots can use TCP/IP to connect to a single instance of MySQL running either outside of the chroots or within its own chroot. Each chroot will need a copy of PHP if they are to run PHP apps. – Ignacio Vazquez-Abrams Mar 12 '11 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.