Putting Apache in Jail - Preparing PHP to work in jail

(Page 3 of 5 )

To make PHP work in jail, you should install it as normal. Establish a list of shared libraries required and copy them into the jail: 

  # ldd /chroot/apache/usr/local/apache/ libexec/libphp4.so
      libcrypt.so.1 => /lib/libcrypt.so.1 (0x006ef000)
       libresolv.so.2 => /lib/libresolv.so.2 (0x00b28000)
       libm.so.6 => /lib/tls/libm.so.6 (0x00111000)
       libdl.so.2 => /lib/libdl.so.2 (0x00472000)
       libnsl.so.1 => /lib/libnsl.so.1 (0x00f67000)
       libc.so.6 => /lib/tls/libc.so.6 (0x001df000)
       /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x00494000)

Some of the libraries are already in the jail, so skip them and copy the remaining libraries (shown in bold in the previous output):

  # cp /lib/libresolv.so.2 /chroot/apache/lib
  # cp /lib/libnsl.so.1 /chroot/apache/lib

One problem you may encounter with a jailed PHP is that scripts will not be able to send email because the sendmail binary is missing. To solve this, change the PHP configuration to make it send email using the SMTP protocol (to localhost or some other SMTP server). Place the following in the php.ini configuration file:

  SMTP = localhost

Preparing Perl to work in jail

To make Perl work, copy the files into the jail:

  # cp -dpR /usr/lib/perl5 /chroot/apache/usr/lib
  # mkdir /chroot/apache/bin
  # cp /usr/bin/perl /chroot/apache/bin

Determine the missing libraries:

  # ldd /chroot/apache/bin/perl 
           libperl.so => /usr/lib/perl5/5.8.1/i386-linux-thread-multi
  /CORE/libperl.so (0x0067b000)
           libnsl.so.1 => /lib/libnsl.so.1 (0x00664000)
           libdl.so.2 => /lib/libdl.so.2 (0x0060b000)
           libm.so.6 => /lib/tls/libm.so.6 (0x005e7000)
           libcrypt.so.1 => /lib/libcrypt.so.1 (0x00623000)
          libutil.so.1 => /lib/libutil.so.1 (0x00868000)
          libpthread.so.0 => /lib/tls/libpthread.so.0 (0x00652000) 
           libc.so.6 => /lib/tls/libc.so.6 (0x004ac000)
           /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x00494000)

Then add them to the libraries that are inside:

  # cp /lib/libutil.so.1 /chroot/apache/lib
  # cp /lib/tls/libpthread.so.0 /chroot/ apache/lib

Next: Taking care of small jail problems >>
 

More Apache Articles
More By O'Reilly Media

Comments On: Putting Apache in Jail

· This article is an excerpt from the book "Apache Security," published by O'Reilly....   >>> Post your comment now!

Buy this book...

This article is excerpted from chapter two of Apache Security, written by Ivan Ristic (O'Reilly; ISBN: 0596007248). Check it out today at your favorite bookstore. Buy this book now.