Comments on: Lighttpd FasCGI PHP, MySQL chroot jail installation under Debian Linux

By: none-101

none-101 — Mon, 17 Oct 2011 15:01:48 +0000

Where do you put the static web files that one wishes to serve?
I have these on /www/ Is it possible, using your set-up above to still server from /www. These are on different partitions.

Regards.

By: maximebuy

maximebuy — Wed, 13 Apr 2011 22:48:12 +0000

I followed the instruction and got 400 error also. Then I made the following changes:
1. change the base dir in /etc/lighttpd/lighttpd.conf from /var/www to /home/lighttpd
2. change the cache dir from /webroot/var/tmp/lighttpd/cache/compress/ to /webroot/var/cache/lighttpd/compress/
3. change the /etc/lightpd/conf-enablede/10-fastcgi.conf, where /usr/bin/php-cgi to /usr/bin/php5-cgi

Then I can open the db.php and test.php, my system is “PHP Version 5.2.6-1+lenny10″.

After these three steps, there are still some error in output of db.php, just see the log file in /webroot/var/log/lighttpd/error.log and check the errors.

By: jh

jh — Thu, 16 Dec 2010 02:49:48 +0000

Followed the guide to put my lighttpd server into jail. All working fine except DNS resolution not working in chroot jail. Turn out I have to copy both libnss_dns.so.2 and libnss_dns-2.7.so from /lib to /webroot/lib. Great guide.

By: Christoph

Christoph — Mon, 06 Dec 2010 17:14:04 +0000

nice tutorial

The default path of the compress cache directory in Debian is now “/var/cache/lighttpd/compress/”.

So the diretory “/webroot/var/cache/lighttpd/compress/” should exists to work (instead of the directory in the tutorial). ;)

By: Julien

Julien — Sun, 29 Aug 2010 19:58:52 +0000

Thanks for the howto, I used it as a based to my own script that chroot nginx and php on Debian. I believe it might be of interest to some of the readers here, so here is the link.

By: lfitz

lfitz — Wed, 16 Jun 2010 01:31:23 +0000

hi, i get 403 – forbidden errors for db.php and test.php, how can i fix this?

By: james

james — Mon, 12 Apr 2010 09:52:17 +0000

Hi. I have followed carefully each steps and I received this error when starting lighttpd:

(mod_fastcgi.c.1042) the fastcgi-backend /usr/bin/php-cgi failed to start:
(mod_fastcgi.c.1046) child exited with status 9 /usr/bin/php-cgi
(mod_fastcgi.c.1049) if you try do run PHP as FastCGI backend make sure you use the FastCGI enabled version.
You can find out if it is the right one by executing ‘php -v’ and it should display ‘(cgi-fcgi)’ in the output, NOT (cgi) NOR (cli)

lighttpd has been working fine before I wanted to put it in jail. whenever I comment out the server.chroot line. everything works ok.

i have set correctly /usr/bin/php-cgi correctly to /usr/bin/php5-cgi but still the same error.

By: SilentHunter

SilentHunter — Fri, 12 Mar 2010 16:51:53 +0000

Sorry but again to this problem:

————————————————————————————————————
I used this tutorial with Debian Etch rc3 and PHP5. It works fine until I want to use php fastcgi. After enable FASTCGI with “lighty-enable-mod fastcgi”, I changed /etc/lighttpd/conf-enabled/10-fastcgi.conf:

FROM:
“bin-path” => “/usr/bin/php4-cgi”,
“socket” => “/tmp/php.socket”,

TO:
“bin-path” => “/webroot/usr/bin/php5-cgi”,
“socket” => “/webroot/tmp/php.socket”,

After restart lighttpd I get an error message:
“unix: /webroot/tmp/php.socket could not be found or is not writeable”
————————————————————————————————————–

Is there a better solution than cutting the /webroot? I get the same error with the socket but without the /webroot it wouldn’t work anyway….

By: grand wazoo

grand wazoo — Fri, 29 Jan 2010 16:39:48 +0000

If you’re a “noobie who need[s] help,” then you shouldn’t be preparing an externally facing chroot’ed security-critical linux web server installation. Pay someone to do this for you. Security is really, really, really hard. Buck up.

By: mandible

mandible — Tue, 05 Jan 2010 00:45:00 +0000

this website sucks, typical linux users who dont give a shit about noobies who need help, this tutorial doesnt work. install latest debian, and use php5 instead of 4, and follow this tutorial, it doesnt work.

By: maxBirdy

maxBirdy — Mon, 09 Nov 2009 01:35:57 +0000

i run through this whole tutorial

i make sure that /home/lighttpd/ is the root dir

and that /webroot is the chroot jail

then i restart lighty

all is good, and it restarts without any errors

then i type in, 127.0.0.1, or 192.168.1.8, firefox goes “Firefox can’t establish a connection to the server at x.x.x.x” my port 80 is forwarded, but when i go to canyouseeme.org, it says port 80 is not in use.

i run ps aux in bash shell, i see nothing that says “lighttpd”

im using php5, mysql 5.1, and lighttpd 1.4.23

wtf is wrong with my setup, just because my software is newer shouldnt change anything right?

the.conf files for lighty on this site, and mine, are identical, in configuration, but mine has a few other settings that are commented out so i just leave them be.

i have even checked my error logs, not a damn thing is in them

and ive checked my network configuration, all is well there too.

plllleeeeeeeaaaaaaaasssssseeeeeeeeeee help, im really lost and frustrated.

By: L1ttl3J1m

L1ttl3J1m — Thu, 30 Apr 2009 09:53:09 +0000

For $DEITY’s sake, don’t approve that last one :) Try this one instead.

I had some trouble getting it to work, but here’s some stuff I worked out.

For missing libraries (blahblah.so.whatever) you can do this;

ldd ./ – Which you can find by looking in the PHP error log. I found it especially good for this one;

PHP Startup: Unable to load dynamic library ‘blahblah.so’ – File not found in Unknown on line 0

So do an LDD on that file (ldd ./ (be in the directory where the file is, of course)) and it outputs the libraries that that extension needs to run – scatter those around in the jail versions of /lib, /opt/lib, usr/lib, /usr/local/lib, and those errors stop happening.

For the ones that it didn’t make go away (I’m looking at you, MySQL!), doing;

ldconfig -p | grep (name of broken process**)

will give you a few more to copy across.

The thing that I was wondering about though, is how to go about securing that tmp folder. I don’t like the idea of having a world-executable folder on my server, no matter how jailed it is.

Any ideas?

*Make sure you don’t forget to set that one to a path that’s inside the jail, too, otherwise PH can’t write to it and you’ll never see these handy-dandy helpful messages. ***

** MySQL, grep bz for bzip & bzip2, for example – one for each extension that’s in your PHP.ini file, basically.

*** That’s sarcasm, by the way. File not found in Unknown at line 0, yeah that’s helpful!

By: Janez Dolinar

Janez Dolinar — Fri, 17 Apr 2009 10:13:29 +0000

(i know this is an old reply but I had the same problem)

@magnus: make sure, you copied files correctly. In my case I had /webroot/lib64 as a file!

By: Vivek Gite

Vivek Gite — Wed, 18 Mar 2009 08:19:18 +0000

No.

By: niyo

niyo — Wed, 18 Mar 2009 02:35:47 +0000

Can this chrooted setup be managed by cpanel or ispconfig?

rgds
Niyo

By: mdev

mdev — Sun, 20 Jul 2008 11:59:15 +0000

Thanks although some things do not work when using your tutorial and need changes I got it running and learned alot on trial and error.

By: Mike

Mike — Wed, 30 Apr 2008 16:14:09 +0000

Question: What about the ‘*.pid’ files? Can they stay where they are or do I have to copy them into the jail too?

By: Mike

Mike — Wed, 30 Apr 2008 14:51:28 +0000

Hmmm…I guess I got it. I had to copy the ‘pdo.so’ file to, which was not showing with ‘dpkg -L php5-mysql’ :-)

By: Mike

Mike — Wed, 30 Apr 2008 14:03:54 +0000

Ahhh…now I see. The step where you have to create the ‘/var/www’ and the ‘/var/run’ within the /webroot is missing in this tutorial. Thanks for the fast reply! However, if I start lighty I get a bunch of errors (spawning fcgi etc.), I’m now very insecure, I guess i leave it alone as I’m not enough experienced to adapt it to Debian Etch 4, MySQL5, PHP5 and Tomcat5 (in the end I make somewhere a mistake and it’s not more secure then before). :-(

By: vivek

vivek — Wed, 30 Apr 2008 13:53:03 +0000

Mike, Yes, you need to use current path:

/usr/lib/php5/20060613+lfs/mysql.so
/usr/lib/php5/20060613+lfs/mysqli.so

You can run almost anything in jail including tomcat, python and other stuff. All you have to do is copy required to jail. > base-docroot doesn't exist: /webroot/var/www/ You need to follow modified lighttpd.conf file. In jail /webroot/var/www becomes /var/www only. This tutorial changes /var/www to /home/lighttpd/domain1.com. Refer config file.