29.19. The /chroot/etc directory

Now we must set some files in the chroot jail directory immutable for better security.

1. Set the immutable bit on passwd file:

   [root@deep ]/# cd /chroot/httpd/etc/ [root@deep ]/# chattr +i passwd

2. Set the immutable bit on group file:

   [root@deep ]/# cd /chroot/httpd/etc/ [root@deep ]/# chattr +i group

3. Set the immutable bit on httpd.conf file:

   [root@deep ]/# cd /chroot/httpd/etc/httpd/conf/ [root@deep ]/# chattr +i httpd.conf

4. Set the immutable bit on resolv.conf file:

   [root@deep ]/# cd /chroot/httpd/etc/ [root@deep ]/# chattr +i resolv.conf

5. Set the immutable bit on hosts file:

   [root@deep ]/# cd /chroot/httpd/etc/ [root@deep ]/# chattr +i hosts

   Set the immutable bit on nsswitch.conf file:

   [root@deep ]/# cd /chroot/httpd/etc/ [root@deep ]/# chattr +i nsswitch.conf

Copy the localtime file to the jail so that log entries are adjusted for your local timezone properly:

[root@deep ]/# cp /etc/localtime /chroot/httpd/etc/

Remove unnecessary Apache files and directories:

[root@deep ]/# rm -rf /var/log/httpd/ [root@deep ]/# rm -rf /etc/httpd/ [root@deep ]/# rm -rf /home/httpd/ [root@deep ]/# rm -f /usr/sbin/httpd

We can remove safely all of the above files and directories since they are now located under our chroot jail directory.

Normally, processes talk to syslogd through /dev/log. As a result of the chroot jail, this won't be possible, so syslogd needs to be told to listen to /chroot/httpd/dev/log. To do this, edit the syslog startup script, vi /etc/rc.d/init.d/syslog to specify additional places to listen.

daemon syslogd -m 0

To read:

daemon syslogd -m 0 -a /chroot/httpd/dev/log

The default httpd script file of Apache starts the daemon httpd outside the chroot jail. We must change it to now start httpd from the chroot jail.

1. Edit the httpd script file, vi /etc/rc.d/init.d/httpd and change the line:

   daemon httpd

   To read:

   /usr/sbin/chroot /chroot/httpd/ /usr/sbin/httpd -DSSL

2. rm -f /var/run/httpd.pid

   To read:

   rm -f /chroot/httpd/var/run/httpd.pid