Home / server / Questions / 217127
Accepted
Calvin Froedge
Asked: 2010-12-30 09:58:36 +0800 CST

Chroot for Mysql running on Ubuntu 10.10?

  • 772

Prompted from a question about MySQL server security best practices, I've been running through this list (with a few minor alterations) to properly secure my server database server:

http://www.greensql.net/publications/mysql-security-best-practices

On step 10, I'm told to change the root directory for the mysql user using chroot, but very few specifics are provided and I'm not sure where to start. Does anyone know of a good resource for walking me through the steps to properly create a chrooted environment for Ubuntu 10.10?

ubuntu mysql chroot

2 Answers

  1. My guess is that the author of that guide had "Chroot jail" as a bullet point in his outline, but then shrank away from giving the full details when it became clear that getting MySQL to work correctly within a chroot jail is not trivial.

    Basically, chroot jailing any daemon involves setting up an environment in which the daemon will find all the filesystem resources it needs inside the jail, and that can include things like /etc/{passwd,group}, /usr/{bin,lib}/, /var/{log,run,lib}/, and so on. Every daemon has different specific needs, so unfortunately, there is no one-size-fits-all guide to chrooting.

    If you're really serious about chroot jailing MySQL, I found a Debian/Ubuntu-specific recipe which at least one commenter claims works for versions as recent as Debian Lenny and MySQL 5.

    • 2
  2. Best Answer

    In a chroot for MySQL to work you would basically have to recreate a separate Linux distribution.

    I put my databases (MySQL and PostreSQL) into OpenVZ containers - it's chroot but more. It provides other features that chroot does not provide: resource control, network isolation, and more. The main upside is that it does everything for me - I just select a template for the container, run vzctl create 101 --ostemplate ubuntu-10.10-x86_64 and I have a container (a working chroot++) ready.

    To get the container into production I have to setup a local or public IP address and increase the default resource limits.

    To get OpenVZ one has to install and reboot into an OpenVZ patched kernel which is available in a number of major Linux distors but unfortunately OpenVZ has been discontinued as an official Ubuntu package. It is supported in Debian and will be in Debian 6.0.

    • 2