Harder Apache Web Server Security

In the last issue we had discussed about CGI and FastCGI, which allow the
Apache daemon to run scripts such as Python or Perl on the web server. This can
prove to be dangerous as somebody can access (even unintentionally) the file
system of the OS on which Apache resides and make changes to it. He can delete
files knowingly or unknowingly, or even corrupt them, which can increase the
downtime of your web server. If we restrict Apache from accessing the whole file
system, then the problem is solved. Chroot is one such option that allows you to
restrict the file system and limit Apache's access. It helps in changing the
directory structure of your file system; in other words in shifting the base
directory from one location to another. In other words, it can fork the existing
file system, similar to the Solaris container.

But yes the implementation process is a bit complicated. You first require
some extra library files and if you plan to run a scripting language like
Python, then one needs to copy all necessary files and binaries to the base
directory.

In this article, we will discuss how you can create a restricted zone for
Apache and safeguard your file system. For this we need to create a folder,
called Jail, which will be the base directory for Apache. We used Fedora 10.

Creating Jail

Jail contains a smaller version of the existing file system, virtually
resembling a full file system for Apache. For creating Jail, first create a
folder named 'jail' which will contain exactly the same directory tree as httpd
directory. Now, execute the following commands for creating the required tree:

# mkdir /jail/httpd

# mkdir /jail/httpd/dev

# mkdir /jail/httpd/lib

# mkdir /jail/httpd/etc

# mkdir -p /jail/httpd/usr/sbin

# mkdir /jail/httpd/usr/lib

# mkdir /jail/httpd/usr/libexec

# mkdir -p /jail/httpd/var/run

# mkdir -p /jail/httpd/var/log/apache

# mkdir -p /jail/httpd/home/httpd

After you have created the directory structure inside the jail directory, set
proper permissions for all folders, so that they can be modified only by the
root user.

# chown -R root /jail/httpd

# chmod -R 0755 /jail/httpd

# chmod 750 /jail/httpd/var/log/apache/

As we have put Apache inside 'Jail' directory, the root directory for Apache
will be 'jail.' So, it will not be able to access the null device (which handles
the unwanted output stream for Apache) and we need to make it available. Also,
copy the file configuration, cgi-bin and httpd directories to the Jail folder.
For creating the null device and copying the necessary files, execute the
following commands with proper permissions:

# cp -r /etc/httpd /jail/httpd/etc/

# cp -r /home/httpd/cgi-bin /jail/httpd/home/httpd/

# cp -r /home/httpd/your-DocumentRoot /jail/httpd/home/httpd/

# mknod /jail/httpd/dev/null c 1 3

# chown root /jail/httpd/dev/null

# chmod 666 /jail/httpd/dev/null

# cp /usr/sbin/httpd /jail/httpd/usr/sbin/

Now find out the files that are linked to such shared libraries with Apache.
For this run the following command on Fedora:

# ldd /usr/sbin/httpd

linux-vdso.s=> (0x00007fff2a7fe000)

libm.so.6 => /lib/libm.so.6 (0x0000000000331000)

libpcre.so.0 => /lib/libpcre.so.0 (0x00000000005b6000)

libselinux.so.1 => /lib/libselinux.so.1 (0x00000000007e5000)

libaprutil-1.so.0 => /usr/lib/libaprutil-1.so.0 (0x0000000000a01000)

libcrypt.so.1 => /lib/libcrypt.so.1 (0x0000000000c23000)

libdb-4.7.so => /lib/libdb-4.7.so (0x0000000000e5b000)

libexpat.so.1 => /lib/libexpat.so.1 (0x000000006bea7000)

libapr-1.so.0 => /usr/lib/libapr-1.so.0 (0x00000000978bb000)

libpthread.so.0 => /lib/libpthread.so.0 (0x00000000e376f000)

libdl.so.2 => /lib/libdl.so.2 (0x00000000011cf000)

libc.so.6 => /lib/libc.so.6 (0x00000000013d3000)

/lib/ld-linux-x86-64.so.2 (0x0000000000110000)

libuuid.so.1 => /lib/libuuid.so.1 (0x000000000e8e8000)

After you find out the files that are shared with Apache, copy them inside
the lib directory of httpd which resides inside the jail directory. For doing
so, run the following command (but stop the httpd daemon first):

#cp /lib/libm.so.6 /jail/httpd/lib/

#cp /lib/libpcre.co.0 /jail/httpd/lib/

#cp /lib/libselinux.so.1 /jail/httpd/lib/

#cp /usr/lib/libaprutil-1.so.0 /jail/httpd/lib/

#cp /lib/libcrypt.so.1 /jail/httpd/lib/

#cp /lib/libdb-4.7.so /jail/httpd/lib/

#cp /lib/libexpat.so.1 /jail/httpd/lib/

#cp /usr/lib/libapr-1.so.0 /jail/httpd/lib/

#cp /lib/libpthread.so.0 /jail/httpd/lib/

#cp /lib/libdl.so.2 /jail/httpd/lib/

#cp /lib/libc.so.6 /jail/httpd/lib/

#cp lib/ld-linux-x86-64.so.2 /jail/httpd/lib/

#cp /lib/libuuid.so.1 /jail/httpd/lib/

As discussed earlier, you need some extra libraries. Execute the following
commands to copy the extra libraries:

# cp /lib/libnss_compat* /jail/httpd/lib/

# cp /lib/libnss_dns* /jail/httpd/lib/

# cp /lib/libnss_files* /jail/httpd/lib

Next copy the password and group file to the httpd jail directory. For this,
execute the following command:

# cp /etc/passwd /jail/httpd/etc/

# cp /etc/group /jail/httpd/etc/

We also need to create tmp folder inside the httpd folder, inside the jail
directory:

# mkdir /jail/httpd/tmp

# chmod +t /chroot/apache/tmp# chmod 777 /chroot/apache/tmp

For testing the configuration, start the syslog and httpd daemon. And for
checking whether Apache is running in jail, run the following command:

# ls -la /proc/12314/root/

Your output should be:

dev

etc

home

lib

usr

var

Now you have a formal directory structure and any file that is corrupted
would be traceable within these directories and not outside. In case you have
any doubts or queries, please post them at forums.pcquest.com.