Description mod_chroot

mod_chroot is a module for the apache webserver to easily run the httpd in a chroot (especially important for all the scripts). Because of this scripts cannot effect anything outside the chroot and makes it much more difficult to gain access to a server through the webserver for an attacker.

NOTE: apache-2.2.10 and higher has built in chroot handling and the mod_chroot module should not be used.

Why is it so fancy?

Good thing about this module is that you don’t have to maintain a chroot containing every file the apache httpd may need (libraries, etc.).

TODO

• Include a solution to handle sending email from the chroot with PHP mail() function. Several possibilities are available. Didn't test any because I didn't need it myself.
• Add more information for services which might be affected.
• Include information regarding DNS resolving.

HOWTO

Its aimed at my local setup so you might want to change some paths/leave some parts out. I decided to locate the chroot at /var/chroot/apache

Install & Configure

install the module

apt-get install libapache2-mod-chroot

enable the module

a2enmod mod_chroot

set chroot path

echo "ChrootDir /var/chroot/apache" > /etc/apache2/conf.d/mod_chroot

Build chroot

create the chroot directory

mkdir -p /var/chroot/apache

apache needs this to run

mkdir -p /var/chroot/apache/var/run 

PHP5 Session stuff

Some PHP5 programs might need this. At least dokuwiki wanted to create some session file (maybe you don't need this)

mkdir -p /var/chroot/apache/var/lib/php5

use chmod to set php5 dir to drwx-wx-wt

Fixing up mod_user

In case you want to user mod_user for the personal webspaces of users (hostname/~username)

/home and /etc/passwd are nessecary in the chroot

mkdir -p /var/chroot/apache/home
mkdir -p /var/chroot/apache/etc
touch /var/chroot/apache/etc/passwd
echo "/home /var/chroot/apache/home none bind 0 0" >> /etc/fstab
echo "/etc/passwd /var/chroot/apache/etc/passwd none bind 0 0" >> /etc/fstab

obviously you also have to mount them

Fix apache2ctl

ln -s /var/chroot/apache/var/run/apache2.pid /var/run/apache2.pid

Finish it up

restart apache2 to load mod_chroot

/etc/init.d/apache2 restart

Other notes

MySQL

If DNS resolving doesn't work you might need to connect to the ip address (127.0.0.1 for localhost). However MySQL sees localhost different from 127.0.0.1 if you connect to it. So in case you only allow clients from localhost in your MySQL configuration, you also need to allow it from 127.0.0.1 seperately.

Source

• blog entry: http://users.lichtsnel.nl/~spacey/?p=132

• mod_chroot website: http://core.segfault.pl/~hobbit/mod_chroot/

Discussion