Rocky Olsen wrote:
> Herm, Bugger.
>
> Well i guess the question to be asked is, does anyone know of a way to
> chroot apache inside <VirutalHost>'s. Say when a connection comes in for a
> vhost and the parent process spawns the child to handle it, that child
> chroot's itself in the vhost's directory?
For that to happen you would need to run Apache as root, perform
chroot and suid on every request, and configure children to die
after serving only one request. It's perfectly possible, but would
probably suffer a performance penalty. There are suid modules
around, but I haven't heard of one that allows chroot too.
But you can do the following:
Run a separate Apache instance for each <VirtualHost>, chrooted
and running as the user. Install one Apache instance in front
and use it as a reverse proxy. This is a very secure and flexible
solution but it requires a lot of memory. It is thus only suitable
when there is a small number of virtual hosts.
--
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org
|
