Freebsd: Separating apache service and www-data(htdocs) with jails, is it worth it?

Question

Is it worth separating www-data and apache service from each other, in jails?

I currently have this setup:

Freebsd 9

1x Public ip (jails are in private ip's, nat'ed)

2 separate domains, managed by 1 person each.

• Jail1: apache service
• Jail2: mysql service + database files

I've been thinking about adding:

• Jail3: www-data(htdocs) with a nullfs mount into jail 1 (apache), read only. This jail will only be accessible through ssh, via a filtered port.

The idea is to separate the available content and the public facing apache service. Should someone be able to gain access to the apache jail, they will not be able to upload or modify content, considering they are located on a completely different jail.

I think separating ssh login and the apache service adds an extra layer of security. Someone who would ssh in to upload their files would not be able to disrupt the apache service. It would also not give an attacker the ability to tamper with apache.

However, I'm not certain if it's worth it. Maybe chmod gives same security as the above? How would you secure your webserver when having apache, mysql, freebsd and jails?

Answer 1

I don't know if it is worth it, either.

I think taking regular backups of your web content might give you some of the benefits of jailing off the web-content from the Apache server, and backups might be easier to implement. Backups don't prevent a compromised Apache server from modifying the web-content, but it gives you a way to roll back to an uncompromised state if you should get compromised.

Ultimately, only you can decide whether it is worth the effort, but my sense is that jailing off the web-content separately probably isn't worth it. It won't help with the most common kinds of vulnerabilities. These days, vulnerabilities in the Apache server itself are relatively rare. Instead, the most common case is vulnerabilities in the web application (e.g., in PHP/Ruby/Java code), and jailing off the web content won't help with those kinds of vulnerabilities. Therefore, I think I'd recommend that you focus your hardening efforts on defenses and mitigations that help with application-layer vulnerabilities in your web applications.

Answer 2

Separating MySQL and your web application is very important. This can be done incorrectly. For instance on Ubuntu 10.04 it was possible to bypass AppArmor's process isolation use mysql's into outfile to create a php file in /tmp and then use a Local File Include vulnerability to execute it. A chroot jail should not be vulnerable to this issue.

However, most attacks are not as complex. Most often attacker are using bots to compromise as many machines as possible. Sometimes these bots look for index.html or index.php file and add an iframe to these pages to try and compromise browsers. To prevent this I would chown the web root as another user, root would work, and then do a chmod 550 -r WEBROOT. Make sure apache is in the group.

However, a chroot jail and changing file permissions doesn't prevent common vulnerabilities such as sql injection or xss. It is possible to deface the front page of a website using stored XSS. To address these issues i would first test your application using a web application scanner. Open source tools like wapiti and skipfish, I work for a company that provides a free vulnerability scanning service. Automated tools can't detect everything, but its better than nothing. After the application has been tested I recommend using an open source Web Application Firewall such as mod_security.