Web server security: prevent the site from getting out of its folder

Question

Apache HTTP Server

Good evening!

Actually this question: it is necessary to forbid a certain site apache to get out beyond its DocumentRoot folder

. We have: a server with debian, apache2-mpm-itk

User testuser
is made chroot, through ssh in / home the user sees only himself. physically, the user is in /home/jail/home/testuser DocumentRoot folder for Apache - /home/jail/home/testuser/www in the apache config of the testuser virtual host , which, in theory, should be done so that Apache for the testuser site starts from his name. However, let's say that by running the testuser site script, you can clearly see the contents of the Apache config.
[email protected]:~$ ls /home
testuser



AssignUserId testuser testuser

#!/usr/bin/perl
print "Content-type: text/html\n\n";
open FILE, "/etc/apache2/apache2.conf" or die $!;
print <"FILE">;

How to avoid it? How can you make it so that scripts run on the testuser site cannot go beyond the testyuser environment?

Answer 1

You are confusing sour with hot :) It doesn't matter where and what lies, the main thing is who and what rights to "it" :)
If you have rights for all users to read the /etc/apache2/apache2.conf file, then it will be be read by any user :) and what does the site have to do with it?
Don't want testuser to read /etc/apache2/apache2.conf, remove permissions and that's it :)

Answer 2

In fra there is such a thing as jail, in Linux it is, in my opinion. can be solved through Selinux.

Answer 3

"Get out" needs to be specified. exiv.habrahabr.ru is right.

Answer 4

All this must be configured through apparmor/selinux. Hemorrhoid is still the same, but it's worth it.
Apache in chrut to lay down more expensively. It is necessary to recreate the entire local structure of binaries and configs for each site. It's easier to scatter sites on openvz containers.

Answer 5

In debian, by default, read permissions are incorrectly configured, you need to change that reading etc for everyone except root is prohibited - this will solve all problems.
chroot is not required for virtual hosts, it was created for something else, for this there is mpm-itk itself.

Answer 6

Install mod_chroot for apache if I understand correctly what you want