Hello All.<br><br>Thanks for the feedback.<br><br>Igor, as for the jail, it's nothing nginx specific, but as a relative FreeBsd newbie, it's a little overwhelming to setup the jail. I've gotten most of the way there but usually am at a loss at the last few steps.<br>
<br>I've moved my ftpd to listen only on the internal network now and so now the only internet facing daemons I have are sshd (running on a non-standard port with root logins disabled) and the nginxd which I will chroot now. I think this along with ipfw should be safe enough for now until I have a better handle on freebsd.<br>
<br>As always, thanks for your helps guys. And as the original poster of the 'config for static files', I've now finalized the setup and configs and ran ab against it and am consistently clocking in 6000 RPS when running ab against it from a remote machine. This really is quite amazing.<br>
<br><br><div class="gmail_quote">On Fri, Apr 11, 2008 at 1:25 PM, Ed W <<a href="mailto:lists@wildgooses.com">lists@wildgooses.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000"><div class="Ih2E3d">
Cliff Wells wrote:
<blockquote type="cite">
<pre>On Fri, 2008-04-11 at 05:36 -0400, Amer Shah wrote:
</pre>
<blockquote type="cite">
<pre>I'm about to throw the towel in. I was wondering how big a deal is it
to not run it in a jail. Is chrooting it sufficient. What do people
around here normally
do ?
</pre>
</blockquote>
<pre>I usually run it as a normal process (as user nginx). It's the
applications I worry about more than the web server itself. Since Nginx
(unlike a typical Apache configuration), doesn't run applications within
its own process space (unlike Apache's mod_php, mod_python, etc), it's
fairly easy to run those applicatons under separate users and this
greatly alleviates many security risks.
</pre>
</blockquote>
<br></div>
Have you played with any MAC schemes, eg grsecurity? Quite good for
locking a user into a defined set of directories and you can even limit
permissions to do stuff like incoming or outgoing net connections (why
would your PHP user need to create an outgoing network connection other
than when the user account is compromised...). This can greatly
decrease the damage an attacher can do<br>
<br>
Ed W<br>
</div>
</blockquote></div><br>