I'm hosting multiple websites on one VPS, and want to chroot each website, eg. /chroot/website1 /chroot/website2

I'm using makejail, which is a highlevel tool, for creating the jails, and copying the libraries and dependencies. Easy peasy.

Each website will need nginx, php and mysql. For php I'm using php5-fpm which actually supports chroot by configuration, however I'm not using this (maybe I should?)

My question is which approach of the following three is the better:

1) Every website will have its own seperated instance of nginx, php and mysql. The downside is, that each webserver + php has to listen to a different port. I also need a "master" nginx web server in front of them, reverse proxying to the chrooted servers behind it. Probably most secure, but also most advanced.

2) I don't make any chroot jails manually. I setup one nginx web server, that proxies php requests to php-fpm, on different ports. I can have multiple php-fpm configurations each with is own chroot'ed folder. This is quite managable - however only php will be chrooted. Not the actual webserver. Is this secure enough. Also, I tried this option out, and it seems I will need to use TCP instead of sockets for connecting to MySQL.

3) You tell me ;)

I'm quite new to chroot jailing, so please correct me if I'm wrong in my assumptions. I've been reading all the tutorials I could find, however, I find the market for chroot guides very scarce. Any help or inputs much appreciated!


I ended up using option number 2. If I use TCP ( instead of sockets (localhost), most things work out of the box.

Somethings has to be taken care of: sendmail and external services. For sendmail you can use mini_sendmail. Pretty easy to setup if you use makejail (Debian/Ubuntu package) and follow this tutorial: http://www.cyberciti.biz/tips/howto-setup-sendmail-php-mail-chrooted-apache-lighttpd.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.