mod-security-users

[mod-security-users] questions about chrooting

[posorio7 <pos...@gm...>]

Hello, I'm having a hell of a time trying to get apache to run in jail
using mod_security. Using Fedora Core 1, Apache 1.3.32, mod_security
1.8.5, and mod_ssl.

First of all, what should the chroot path be exactly? Should it be
under the users (/home) or elsewhere? What directories, if any, do I
need to create there, and do I need to chmod anything?

Next is with mod_ssl. 
I get this error many times (several times per second actually) when
restarting with the chroot enabled:

[error] mod_ssl: Child could not open SSLMutex lockfile
/usr/local/apache/logs/ssl_mutex.15168 (System error follows)
[error] System: No such file or directory (errno: 2)

It goes away once I disable the chroot. Looking back in the mailing
list archive found a similiar problem but no confirmed solution. Any
help appreciated, thanks!

Re: [mod-security-users] questions about chrooting

[Ivan R. <iv...@we...>]

posorio7 wrote:

> Hello, I'm having a hell of a time trying to get apache to run in jail
> using mod_security. Using Fedora Core 1, Apache 1.3.32, mod_security
> 1.8.5, and mod_ssl.
> 
> First of all, what should the chroot path be exactly? Should it be
> under the users (/home) or elsewhere? What directories, if any, do I
> need to create there, and do I need to chmod anything?

  We can't give you a definite answer. You can use anything as the
  chroot path as long as you configure everything else properly.

  Below is a step-by-step guide that worked for me.

-----------------------------------------------
   1. Installed Apache + mod_ssl to /usr/local/apache

   2. Made sure it works

   3. Downloaded mod_security from the web site and
      did: /usr/local/apache/bin/apxs -cia mod_security.c

   4. /usr/local/apache/bin/apachectl stop

   5. Changed the module order, as per the manual. It now
      looks like this:

--
ClearModuleList
AddModule mod_security.c
AddModule mod_env.c
AddModule mod_log_config.c
AddModule mod_mime.c
AddModule mod_negotiation.c
AddModule mod_status.c
AddModule mod_include.c
AddModule mod_autoindex.c
AddModule mod_dir.c
AddModule mod_cgi.c
AddModule mod_asis.c
AddModule mod_imap.c
AddModule mod_actions.c
AddModule mod_userdir.c
AddModule mod_alias.c
AddModule mod_rewrite.c
AddModule mod_access.c
AddModule mod_auth.c
AddModule mod_so.c
AddModule mod_setenvif.c
AddModule mod_ssl.c
--

   6. mkdir -p /chroot/apache/usr/local

   7. mv /usr/local/apache /chroot/apache/usr/local

   8. cd /usr/local; ln -s /chroot/apache/usr/local/apache

   9. Configured mod_security with:
      SecChrootDir /chroot/apache

  10. /usr/local/apache/bin/apachectl startssl

  It works!  :)
-----------------------------------------------


> Next is with mod_ssl. 
> I get this error many times (several times per second actually) when
> restarting with the chroot enabled:
> 
> [error] mod_ssl: Child could not open SSLMutex lockfile
> /usr/local/apache/logs/ssl_mutex.15168 (System error follows)
> [error] System: No such file or directory (errno: 2)

  The path /usr/local/apache/logs/ does not exist in the jail. E.g.
  if your chroot path is /chroot you need to make sure
  /chroot/usr/local/apache/logs exists.

  You also need to take care about the module ordering (if you haven't
  done that already) as documented in the manual.

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

Re: [mod-security-users] questions about chrooting

[Ivan R. <iv...@we...>]

posorio7 wrote:
> Thanks for your help, I managed to get apache running in jail. Now my
> problem is with my account files for the websites. It's looking for
> them in /chroot/apache/home/[username]/public_html. I tried doing a
> symlink from /chroot/apache/home to the real /home and when I loaded
> up my sites it game me a 403 forbidden error. It finds the files but
> does not have access to them. What can I do to correct this?

  I don't think it finds the files because it is not possible
  to create symbolic links that would go outside the jail. Perhaps
  the message is because of incorrect permissions of /home, or
  something like that.

  You'll have to put the account files into the jail in order for
  Apache to be able to reach them.

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]