Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment.

BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no.

(I think that prevents me from installing SELinux, AppArmor, etc.)

share|improve this question
2  
Can you clarify your needs? A chroot is usually good enough to jail a server... –  ℝaphink Feb 22 '12 at 10:23
1  
Have a look at this answer - it is a bit more general, but I think you'll find information useful in your scenario. –  rozcietrzewiacz Feb 22 '12 at 11:05
    
@Raphink I'm looking for a way to secure my server running on OpenVZ VPS... –  user269334 Feb 23 '12 at 19:08
add comment

1 Answer 1

Forget the myths about how Chroot isn't a security feature... it is integrated as a security feature into mainstream applications of all sizes and flavors for a reason

OpenVZ is itself basically Chroot on Steroids, and this should, or will be, all that you will need. as long as it is done conforming to the Chroot setup standards and typical procedure.

Generally, If you are simply trying to provide an additional layer of security for NGinx, then use Chroot. You are mainly trying to provide privacy between users by doing this, or providing security from poorly coded content management systems.

this helps protect, for a few minor examples, against directory traversal attacks, remote file inclusion bugs, or executing applications on the base system. it can also help protect against any known, unknown, or future NGinx vulnerabilities, by containing damage to the Chroot directory.

with this said, however, be sure to secure your base system, and check what version of NGinx your operating system repositories are using, and compare it against any security advisories that is currently available for NGinx. you may want to compile to latest stable build and use that instead.

there is a useful application by R-FX Networks that can help protect against some kinds of attacks against a running daemon, without using AppArmor, or SELinux. It is called SNIV.

for more information on why Chroot is still a totally valid security tool in today's day and and age; see this answer I recently gave for a more thorough explanation this scenario.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.