Jail on a http only server

Question

Does it make sense to set up a chroot jail for a apache server which is the only service on the server? Or it is pointless, because the server is in either way lost if it get hacked?

score 0 · Answer 1 · answered Jul 21 '10 at 10:10

0

which is the only service on the server

Really? How do you change the content on the server? Even if that is the case, it does improve security - even if there are no other avenues for attack, it would limit the targets of attacks.

C.

answered Jul 21 '10 at 10:10

symcbean

21,009
1
31
52

score 0 · Accepted Answer · answered Jul 21 '10 at 10:34

Under those condition a chroot might potentially do more damage than good.

Depending on the amount of dynamic content being generated, you might have to copy a rather large chunk of libraries and binaries into the chroot. Unless you also have a easy and convenient way to keep the chroot updated you will most likely sooner or later end up with a rather vulnerable web site.

Jail on a http only server

2 Answers2