FreeBSD 监狱和套接字
我对从 Linux 切换到 freeBSD 还很陌生。
我读到了有关监狱的内容，该解决方案听起来非常适合服务器系统。 所以我对网络服务器的想法是创建 3 个监狱。 1 个 mysql 监狱，1 个 nginx 监狱，1 个 php-fpm 监狱。 现在监狱之间必须相互沟通。我该怎么做？
通过IP？这将是一个很大的开销，但很安全。 这是一个例子：
- 客户端
- -> TCP/IP-> NGINX
- -> TCP/IP-> PHP-FPM
- -> TCP/IP-> MYSQL
- -> TCP/IP-> PHP-FPM
- -> TCP/IP-> NGINX
- -> TCP/IP->客户
：这将是一个安全损失..
- 在主机系统上创建一个目录
- 在监狱中创建一个目录
- 合并目录
您使用哪种解决方案？或者您有更好的解决方案吗？
I'm quite new to freeBSD switching from Linux.
I read about jail, the solution sound great for Server Systems.
So my idea for my webserver was to create 3 jails.
One jail for mysql, one for nginx and one for php-fpm.
Now the jails have to communicate with each other. How do I do that?
Over IP? It would be a big overhead but secure.
Here is an example:
- CLIENT
- -> TCP/IP -> NGINX
- -> TCP/IP -> PHP-FPM
- -> TCP/IP -> MYSQL
- -> TCP/IP -> PHP-FPM
- -> TCP/IP -> NGINX
- -> TCP/IP -> CLIENT
With Sockets: That would be a security los..
- create a directories on the host system
- create a directories in the jails
- merge the directories
Which solution do you use?Or do you have better solutions?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我不会分离 php-fpm 但这是可能的。如今，IP 通信的开销并不是那么大，而且考虑到数据库和 PHP 处理器需要进行的处理要大得多，IP 通信的开销也不是那么重要。特别是因为不涉及实际的电线。数据包通过环回结构通过接口路由，并且不会到达线路。
分离的优点是，如果需要，您可以将监狱移动到另一台物理机器，并且移动监狱是轻而易举的事。
澄清为什么不将 php-fpm 移到单独的监狱中是因为修改网站成为静态内容（图像）和动态内容（php 文件）的两个任务过程。优点是网络服务器软件的漏洞无法修改 php 代码。这也是为什么你不应该
I would not separate php-fpm but it's possible. The overhead for IP communication is not that big these days and not that important considering the processing that the database and php processor need to make is far bigger. Especially since there is no actual wire involved. The packets are routed through the interface via a loopback construct and don't hit the wire.
The advantage of separation is that you can move the jail to another physical machine if need be and moving jails is a breeze.
To clarify why not to move php-fpm in a separate jail is that modifying the website becomes a two-task process for static content (images) and dynamic content (php files). The advantage is that a breach in the webserver software is not able to modify php code. This is also why you should not nullfs your php code onto the webserver jail if you plan to separate as it would defeat it's advantage.
我真的不知道这是否是最好的解决方案，但如果您可以使用 Unix 域套接字，您可以在三个监狱之间共享安装。命名空间是隔离的（它们无法在共享安装点之外创建套接字），并且它们应该能够进行通信。
要创建共享挂载，您可以使用
nullfs挂载。一个很好的（相当高级的）指南Jails 也谈到了nullfs挂载。当然，这个挂载点应该仅用于套接字，其他文件应该保持独立。再说一遍，我不知道这些应用程序是否可以通过 Unix 套接字进行通信，但如果可以，您可能就已经准备好了。
I really don't know if it's the best solution, but if you can use
Unix domain socketsyou can share a mount between the three jails. The namespace is isolated (they can't create a socket outside the shared mount point) and they should be able to communicate.To create the shared mount, you can use a
nullfsmount. A nice (rather advanced) guide about jails also speaks aboutnullfsmounts. Of course, this mount point should be used only for the sockets, the other files should stay separate.Again, I don't know if those applications can communicate over Unix sockets, but if they can you're probably set.