Forum OpenACS Q&A: Response to Anyone running chroot() installation?

Collapse
Posted by Lamar Owen on
Run a chrooted postmaster in the same jail as AOLserver.

Use a different PGPORT than your main , and all works well.

Of course, PostgreSQL has its own issues in chroot() mode....

Then again, you can create a hardlink inside the chroot jail to the /tmp dir easily enough.

But, I've found chroot is more trouble than it is really worth -- AOLserver releases privileges properly -- and the AOLserver run user (for me, it's username 'aolserver') shouldn't own or have write privileges to any AOLserver executables or libraries (or tcl libs, for that matter).

Make the nsd executable owned by root, read-execute only.  This kills the majority of the headaches.

It is easier to set up a properly secured, properly permissioned site without chroot using OpenACS than with chroot, IME.  As part of the OpenACS RPM effort I have been trying to get chroot to work, as well, and it is a big-time pain -- particularly the part about perl.

But, if you insist on doing so, that's perfectly fine.