Системное администрирование → Настройка Debian-based LAMP в chroot-окружении

Настройка Debian-based LAMP в chroot-окружении
chroot в действии

Большинство дистрибутивов linux и unix поставляются с большим разным количеством технологий которые повышают безопасность системы как в целом, так и в каких либо отдельных участках. Например в Убунте это AppArmor, в Федоре это SELinux и тд… Так же повышение безопасности системы повышается путем отключения лишних сервисов, закрытием портов и прочее… Но тем не менее, злоумышленники все-же могут найти способы обойти способы защиты. Строя chroot-окружение, мы так же создаем еще одну «ступеньку» защиты нашей операционной системы. Chroot — это изолированной окружение которое не имеет доступа к основной системе.
Установим пакет debootstrap

debootstrap — используется для создания базовой системы Debian с нуля, не требуя для этого наличия dpkg или APT. Пакеты .deb загружаются из репозиториев, распаковываются в каталог, который затем можно использовать в качестве корня системы для команды chroot.

apt-get install debootstrap

Создаём будущую директорию chroot, она будет называться chroot_web

mkdir /home/chroot_web

Устанавливаем базовую системы в chroot-окружение
Для ubuntu karmic koala

debootstrap --variant=buildd --arch i386 karmic /home/chroot_web http://archive.ubuntu.com/ubuntu/

при этом в Ubuntu можно создавать chroot на базе Debian и наоборот. для этого набираем man debootstrap
В данном chroot осталось настроить резолвер и конфигурацию APT (установщик пакетов), для этого я просто скопировал их из своей ОС

cp /etc/resolv.conf /home/chroot_web/etc/resolv.conf
cp /etc/apt/sources.list /home/chroot_web/etc/apt/

С созданием chroot законченно, теперь необходимо настроить chroot
Для этого нам необходимо войти в chroot окружение.

Далее все команды вводятся относительно chroot-окружения.

sudo chroot /home/chroot_web

Установим необходимые пакеты для закачки, сборки пакетов.

apt-get --no-install-recommends install wget debconf devscripts gnupg

Настраиваем локаль

apt-get install locales dialog
locale-gen ru_RU.UTF-8

Настраиваем время

tzselect; TZ='Europe/Moscow';

Пробрасываем в chroot-окружение системные ФС, в /etc/fstab основной системы прописываем

/proc /home/chroot_web/proc none rbind 0 0
/dev /home/chroot_web/dev none rbind 0 0
/sys /home/chroot_web/sys none rbind 0 0

Настройка chroot закончена. Теперь можно переходить к установке нужных нам сервисов.
Устанавливаем nginx, apache, php5, mysql

apt-get install nginx mysql-server mysql-client libmysqlclient15-dev apache2 apache2-doc apache2-mpm-prefork apache2-utils libexpat1 ssl-cert libapache2-mod-php5 libapache2-mod-ruby libapache2-mod-rpaf php5 php5-common php5-curl php5-dev php5-gd php5-idn php-pear php5-imagick php5-imap php5-mcrypt php5-memcache php5-mhash php5-ming php5-mysql php5-pspell php5-recode php5-snmp php5-sqlite php5-tidy php5-xmlrpc php5-xsl

Включаем модули Apache

a2enmod rewrite
a2enmod suexec
a2enmod include

Устанавливаем memcache

apt-get install memcached

Устанавливаем eAccelerator

cd /tmp/ 
wget http://bart.eaccelerator.net/source/0.9.6/eaccelerator-0.9.6.tar.bz2
tar xvjf eaccelerator-0.9.6.tar.bz2
cd eaccelerator-0.9.6
phpize 
./configure --enable-eaccelerator=shared 
make 
make install
cd /
mkdir -p /var/cache/eaccelerator 
chmod 0777 /var/cache/eaccelerator

Редактируем конфиг PHP

gedit /etc/php5/apache2/php.ini

Добавляем в php.ini

; eAccelerator configuration
; Note that eAccelerator may also be installed as a PHP extension or as a zend_extension
; If you are using a thread safe build of PHP you must use
; zend_extension_ts instead of zend_extension
extension                       = "eaccelerator.so"
eaccelerator.shm_size           = "16"
eaccelerator.cache_dir          = "/var/cache/eaccelerator"
eaccelerator.enable             = "1"
eaccelerator.optimizer          = "1"
eaccelerator.check_mtime        = "1"
eaccelerator.debug              = "0"
eaccelerator.filter             = ""
eaccelerator.shm_max            = "0"
eaccelerator.shm_ttl            = "0"
eaccelerator.shm_prune_period   = "0"
eaccelerator.shm_only           = "0"
eaccelerator.compress           = "1"
eaccelerator.compress_level     = "9"
eaccelerator.allowed_admin_path = "/var/www/eaccelerator"

Теперь необходимо настроить Nginx (fronted), Apache(backend)
NGINX
Редактируем /etc/nginx/nginx.conf

gedit /etc/nginx/nginx.conf

# пользователь, от которого запускается процесс
user www-data;
# кол-во рабочих процессов. Обычно равно кол-ву ядер на машине
worker_processes 2;

error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;

events {
worker_connections 1024;
}

http {
include /etc/nginx/mime.types;
default_type application/octet-stream;

access_log /var/log/nginx/access.log;

sendfile on;
tcp_nopush on;

keepalive_timeout 2m;
tcp_nodelay on;

gzip on;
# Минимальная длина ответа, при которой модуль будет жать, в байтах
gzip_min_length 1000;
# Запрещает сжатие ответа методом gzip для IE6
gzip_disable «msie6»;
gzip_comp_level 8;
gzip_proxied any;
gzip_types text/plain text/html text/css text/javascript text/json text/xml application/x-javascript application/xml application/xml+rss;

include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}

Теперь конфигурируем виртуальные серверы nginx (/etc/nginx/sites-enabled/*)
Пример для хоста localhost

gedit /etc/nginx/sites-enabled/localhost

server {
# Слушать 80 порт
listen 80;

# Использовать следующие хосты
server_name localhost;

# Кодировка
charset utf-8;

# Лог доступа для конкретного виртуального хоста
#access_log logs/host.access.log main;

# Максимальный размер тела запроса клиента
client_max_body_size 101M;

# Разруливаем статику и динамку, смотрите описание ниже в этой статье!
location ~* \.(jpg|jpeg|gif|png|ico|css|bmp|swf|js)$ {
root /home/localhost/www/;
}

location ~ /\.ht {
deny all;
}

location / {
proxy_pass 127.0.0.1:81/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_connect_timeout 120;
proxy_send_timeout 120;
proxy_read_timeout 180;
}
# Адрес страницы 404-ой ошибки, далее все ошибки по аналогии
#error_page 404 /404.html;

# Аналогично 404, только при этом назначается псевдоним 50x.html для всех
# 50x-тых ошибок и далее перенаправляется все на «root»
error_page 500 502 503 504 /50x.html;
location = /50x.html {
# корневая директория
root /var/www/nginx-default;
}
}

APACHE

gedit /etc/apache2/ports.conf

NameVirtualHost *:81
Listen 81

Редактируем конфиг апача

gedit /etc/apache2/apache2.conf

Удаляем следующую запись:

# Include the virtual host configurations:
Include /etc/apache2/sites-enabled/

Редактируем httpd.conf, добавляя виртуальные хосты

gedit /etc/apache2/httpd.conf

<VirtualHost *:81>
# Осн. настройки домена
ServerAdmin info@localhost

ServerName localhost
ServerAlias selfpc
DocumentRoot /home/localhost/www/
#<Directory /home/localhost/www/>
#Order deny,allow
#Allow from all
#</'Directory>
LogLevel warn
ErrorLog "/home/localhost/logs/apache.localhost.error.log"

CustomLog "/home/localhost/logs/apache.localhost.access.log" common

# Остальные настройки
DirectoryIndex index.html index.php

На этом базовая настройка Nginx, Apache закончена.
В этом примере мы установили все сервисы веб-сервера в одно chroot-окружение. Если мы хотим построить еще одну ступеньку безопасности, то мы можем разнести сервисы по разным chroot-окружениям.

Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/templates/compiled/%%27^27A^27A2FB40%%topic.tpl.php on line 130

Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/templates/compiled/%%27^27A^27A2FB40%%topic.tpl.php on line 130
+3
Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 326

Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 326

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 329

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 329

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 334

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 334
9 января 2010, 09:46
mario

не знаю насколько полезно, но молодец!

artoodetoo

Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 326

Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 326

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 329

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 329

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 334

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 334
11 января 2010, 10:14
↓

как сказал дуд, это для параноиков :D коим я и являюсь :)

mario

Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 326

Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 326

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 329

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 329

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 334

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 334
11 января 2010, 17:50
↑
↓

bappoy.pp.ru/2010/01/20/debian-chroot.html

adw0rd

Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 326

Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 326

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 329

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 329

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 334

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 334
20 января 2010, 14:54
↓

это к чему?
ЗЫ не читал, просто пролистал…

mario

Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 326

Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 326

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 329

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 329

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 334

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Moscow' for 'MSK/4,0/no DST' instead in /home/pyha/pyhapyha.ru/include/function.php on line 334
20 января 2010, 17:11
↑
↓

Только зарегистрированные и авторизованные пользователи могут оставлять комментарии.

Системное администрирование → Настройка Debian-based LAMP в chroot-окружении

Комментарии (4)

Прямой эфир

Блоги

Авторизация

Системное администрирование → Настройка Debian-based LAMP в chroot-окружении

Комментарии (4)

Вставка изображения

Прямой эфир

Блоги