01/13/051 Cheap, Easy Virtual Hosts for Web-Based Services Richard L. Goerwitz III

01/13/052 Are you... Flooded with requests for new web servers? –E.g., blogs, wikis –internal test boxes –sandboxes for classes, projects –front ends for apps (e.g., webmail) –dynamic/DB-driven sites for research –cross-institutional, collaborative sites

01/13/053 How Are You Responding? Buying lots and lots of hardware? –1U units –Blades –Re-purposed desktops Setting up virtual HTTP hosts? –Name-based (Apache) virtual hosts –IP-based virtual hosts Moving to virtual hardware? –VMWare –Other server virtualization solutions

01/13/054 Problems With These Responses Buying lots and lots of hardware: –Requires rack space, power, cooling –Costs $$; requires hardware, OS licenses –Means OS installs, more patching Setting up virtual HTTP hosts: –Creates two “single” points of failure –Offers “accounts,” not true sandboxes –Opens horrendous security holes Break-in on one vhost compromises all vhosts Users share single process space, database

01/13/055 More Problems Moving to virtual (VMWare) hardware: –Requires OS licenses, installs, patching, as with real servers –Uses as much disk space as real servers –Requires virtualization licenses and extra in-house expertise –Adds some virtualization overhead –(VMWare) performs poorly on fork/exec

01/13/056 What Have We Missed? Aha! We've missed one solution This solution requires: –Little (or no) additional hardware –Little additional disk space –Few (or no) additional OS licenses –No special virtualization software –No manual patching –No shared webservers or databases

01/13/057 Solution: Chrooted Hosts Unix programs may be chrooted, i.e., run from an alternate root directory Whole sets of programs may be run together from such a root directory Coupled with a basic filesystem, this alternate root can be made to look like a distinct “chrooted” host –Has its own /home, logging, daemons

01/13/058 Chrooted Web Hosts Look/act mostly like full web servers Offer relative security and isolation Serve as terrific sandboxes Can run Apache, database instances Can take remote SFTP xfers (SSHd) Utilize 400 meg apiece as a baseline Cheap!

01/13/059 But, but... Q: Don’t chrooted web hosts require a lot of time and skill to set up and maintain? A: Yes, and no –Setup mostly scripted at Carleton –Patching can also be automated –User credentials can be maintained centrally via LDAP

01/13/0510 But, but... (2) Q: Can't chrooted web hosts be “escaped,” compromising the parent host? A: Yes, but –Difficult (esp. with no /proc, suid stuff) –Requires some skill, compiler tools –Even so, unlikely—especially with strong monitoring and off-host logging

01/13/0511 But, but... (3) Can't one out-of-control chrooted web host impact the performance of all the others? A: Yes, and no –Sure, this can happen –But remember that daemons in chroots live in separate process space –So, a small cron job can go and auto-lower priorities of excessively busy processescron job

01/13/0512 How-To Part 1: Base Server Setup Install RedHat Enterprise Linux AS 2.1/3.x Add Apache, database, related modules Bind base server’s Apache, database, SSHd instances to base IP address Create virtual IP interfaces that chroots will later bind to (in a big batch) Create corresponding generic DNS names Set up LDAP authentication

01/13/0513 How-To Part 2: Template Setup (At Carleton this step is scripted) Run make_chrootenv utility –Reads list of software to go into chrootslist of software –Constructs master chroot template Check template to be sure it has all the desired software –Add software, recreate template as needed

01/13/0514 How-To Part 3: Host Setup Invoke copy_chrootenv utility to set up a new host –Bind to IP address set up earlier on –IP address should have a corresponding generic DNS name like WebHost-1...edu Create CNAME record for new host Add user accounts, software Verify SSHd, HTTPd, etc. startup

01/13/0515 Current Uses at Carleton Current uses for chrooted web hosts at Carleton include: –Blogs, wikis, webmailBlogswikiwebmail –Faculty projects Esternay –Various other one-off sites Caucus GIS (only viewable at Carleton)GIS

01/13/0516 Future Uses at Carleton Future uses of chrooted web hosts at Carleton may include: –Sandboxes for classes, student projects –More faculty projects –Cross-institutional, collaborative projects –On-demand hosts for anyone wanting a private dynamic and/or database-driven website

01/13/0517 Way Out Ideas Build a web interface that allows (e.g., faculty) to create chrooted web hosts on demand Automate setup, archiving, teardown of chrooted web hosts for classes Build a general interface for creating, archiving, and tearing down all chrooted hosts

01/13/0518 Conclusion Chrooted web hosts are not only cool; they've been a life saver: –Easy to set up, patch, maintain –Use little/no disk/rack space –Offer reasonable security –Cost virtually nothing –Help us greatly in meeting demand for web servers and web-based services