Is it worth separating www-data and apache service from each other, in jails?
I currently have this setup:
1x Public ip (jails are in private ip's, nat'ed)
2 separate domains, managed by 1 person each.
- Jail1: apache service
- Jail2: mysql service + database files
I've been thinking about adding:
- Jail3: www-data(htdocs) with a nullfs mount into jail 1 (apache), read only. This jail will only be accessible through ssh, via a filtered port.
The idea is to separate the available content and the public facing apache service. Should someone be able to gain access to the apache jail, they will not be able to upload or modify content, considering they are located on a completely different jail.
I think separating ssh login and the apache service adds an extra layer of security. Someone who would ssh in to upload their files would not be able to disrupt the apache service. It would also not give an attacker the ability to tamper with apache.
However, I'm not certain if it's worth it. Maybe chmod gives same security as the above? How would you secure your webserver when having apache, mysql, freebsd and jails?