On Unix-like operating systems, such as Linux, a chroot jail is the common expression used to describe a section of a filesystem that is sectioned off for a particular user. On a web server, it is particularly useful for the security of shared hosting accounts.
Without a chroot jail, a user with limited file permissions would still be able to navigate to top-level directories. As an example, suppose the user’s directory is /home/user. Without chroot, nothing would prevent the user from navigating up to /home to see other users’ directories or even navigating up to / where they can see /etc, /usr, /var, /lib, and other system-critical directories. Although the user would not have the permissions to edit them, they would be able to see the files and target specific ones to try to exploit.
You could respond to this by saying, “Well, I trust my users.” Unfortunately, it is not just a matter of trust. By allowing your user access, you also allow anyone who can hack their account access. That just creates one more weak link in your security fence.
Many control panels that reconfigure web servers for shared hosting will automatically create chroot directories for user accounts. There is also software that can help you more easily create chroot jails. One such software suite is called Jailkit, which is available for free.
Another important use for chroot is for virtualization. With a virtual private server (vps), the user has a complete operating system installed within a chroot directory. As a result, even though the user has root privileges for his or her own account, the user cannot access higher directories and would not even be aware that they exist (on a technical level). In other words, if the user is in /var/chroot/vhosts/user/, there is no way to move up beyond that /user directory. It will appear to the user as the default root directory, which is /.
Chroot is very useful for basic preventative security, but it is not designed to prevent deliberate attempts to gain root access and attack a server. For that there are other security measures you can take. Nevertheless, chroot helps tremendously to at least make it more difficult to exploit your dedicated server.
- Jail FTP Users to Their Home Directories
- How to Build a Chroot Environment in CentOS
- Full Virtualization vs. a Chroot Environment
- How to Fix a Chroot Network Connection Failure
- Restricting Shared Hosting Accounts