1

I'm in the process of setting up a FreeBSD 10 server with just some services on a KVM server:

  • NGINX webserver w PHP-FPM

    2 domains, 3 subdomains

  • Mailserver

    3 Email addresses

MySQL (or other) database server if needed The server will only be administered by me. One SSH account with sudo access and later a second one with restrictions, mainly for SFTP operations.

I set everything up with ZFS (encrypted root) and am now thinking about whether I should / need to use jails or not.

I'm also unsure if it would make more sense to encrypt the jails and not the root volume although I don't have any idea how to do that.

As I read the security gain of jails can be debated and I'm unsure whether I gain anything with the added complexity of the whole system.

3

It's really up to you.

The benefit of setting up jails is that you're going to separate security issues that come up between the jails, as well as making it easier to upgrade and manage them separately, which can increase reliability.

The downside of setting up the jails of course is that you have to learn it, it's a bit of management overhead, etc.

Personally, I would probably setup a jail for a front end nginx reverse proxy in one jail then a separate web server jail for each web app. This way an issue with one web app wouldn't affect the others. Similarly, the mail server would get it's own jail, as would MySQL.

Take a look at ezjail, it'll make setting up the jails easier.

  • I decided to go down this route. Lots of things to do and to learn but I guess it's worth it in the end. – basbebe Mar 13 '15 at 10:31
  • I'll be using four jails: Mariadb, NGINX+PHP-FPM+Python+uWSGI, Postfix+Dovecot, Memcached. Maybe two others will follow (git and VPN). I realized I won't need a proxy and running the three web apps inside the same jail saves me some hassle. – basbebe Mar 16 '15 at 10:01
  • 1
    @basbebe personally I would really keep the web apps in different jails for security reasons – Steve Wills Mar 16 '15 at 14:24
  • I'm still unsure behause all of the extra instances of NGINX and php. Also it makes configuring and accessing (SFTP) more complicated… – basbebe Mar 16 '15 at 16:54
  • @basbebe understandable, but also consider that PHP is probably the least secure part of the stack. :) Anyway, just my $0.02... – Steve Wills Mar 16 '15 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.