1

I'm in the process of setting up a FreeBSD 10 server with just some services on a KVM server:

  • NGINX webserver w PHP-FPM

    2 domains, 3 subdomains

  • Mailserver

    3 Email addresses

MySQL (or other) database server if needed The server will only be administered by me. One SSH account with sudo access and later a second one with restrictions, mainly for SFTP operations.

I set everything up with ZFS (encrypted root) and am now thinking about whether I should / need to use jails or not.

I'm also unsure if it would make more sense to encrypt the jails and not the root volume although I don't have any idea how to do that.

As I read the security gain of jails can be debated and I'm unsure whether I gain anything with the added complexity of the whole system.

Improve this question

1 Answer 1

Reset to default
3

It's really up to you.

The benefit of setting up jails is that you're going to separate security issues that come up between the jails, as well as making it easier to upgrade and manage them separately, which can increase reliability.

The downside of setting up the jails of course is that you have to learn it, it's a bit of management overhead, etc.

Personally, I would probably setup a jail for a front end nginx reverse proxy in one jail then a separate web server jail for each web app. This way an issue with one web app wouldn't affect the others. Similarly, the mail server would get it's own jail, as would MySQL.

Take a look at ezjail, it'll make setting up the jails easier.

Improve this answer
6
  • I decided to go down this route. Lots of things to do and to learn but I guess it's worth it in the end.
    – basbebe
    Mar 13, 2015 at 10:31
  • I'll be using four jails: Mariadb, NGINX+PHP-FPM+Python+uWSGI, Postfix+Dovecot, Memcached. Maybe two others will follow (git and VPN). I realized I won't need a proxy and running the three web apps inside the same jail saves me some hassle.
    – basbebe
    Mar 16, 2015 at 10:01
  • 1
    @basbebe personally I would really keep the web apps in different jails for security reasons
    – Steve Wills
    Mar 16, 2015 at 14:24
  • I'm still unsure behause all of the extra instances of NGINX and php. Also it makes configuring and accessing (SFTP) more complicated…
    – basbebe
    Mar 16, 2015 at 16:54
  • @basbebe understandable, but also consider that PHP is probably the least secure part of the stack. :) Anyway, just my $0.02...
    – Steve Wills
    Mar 16, 2015 at 20:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .