Disabled shell vs Jailed Shell with mod_ruid2

[sjmnc]

Trying to understand the best shell options and the difference between Disabled Shell and Jailed Shell.

As per security advisor recommendation

Apache vhosts are not segmented or chroot()ed. Enable “mod_ruid2” in the “EasyApache 4” area, enable “Jail Apache” in the “Tweak Settings” area, and change users to jailshell in the “Manage Shell Access” area.

I've

1. Enabled mod_ruid2
2. Enabled EXPERIMENTAL: Jail Apache Virtual Hosts using mod_ruid2 and cPanel® jailshell

However my users are already set to Disabled Shell. If I try to change them to Jailed Shell I get a Package conflict error because none of my packages have shell access enabled.

It seems counterintuitive to enable shell access in the packages just so I can apply the Jailed Shell setting - will doing this offer better security than keeping them at Disabled Shell?

Thanks.

 

[cPRex]

Hey there! If the shell is disabled, that's as secure as you can make it. There's some additional details about this here:

https://support.cpanel.net/hc/en-us/articles/1500011542302-How-to-turn-off-Jail-Apache-Virtual-Hosts

 

[sjmnc]

Thanks cPRex.

 

[Nathan Lyle]

Hey there! If the shell is disabled, that's as secure as you can make it. There's some additional details about this here:

https://support.cpanel.net/hc/en-us/articles/1500011542302-How-to-turn-off-Jail-Apache-Virtual-Hosts

I would have thought that disabled was the most secure as well, but keep getting messages like this:

Apache vhosts are not segmented or chroot()ed. Enable “mod_ruid2” in the “EasyApache 4” area, enable “Jail Apache” in the “Tweak Settings” area, and change users to jailshell in the “Manage Shell Access” area. Consider a more robust solution by using “CageFS on CloudLinux”. Note that this may break the ability to access mailman via Apache.

I have them disabled partially because I didn't want to enable an experimental feature on my main servers, but also because I thought it was the most secure and my clients don't typically need that access. Is this notification mostly an ad to promote CafeFS? It seems like it shouldn't be going out if I have no users set to a normal shell access.

 

[cPRex]

Yes, fully separated users such as CageFS would be the ultimate security solution. It doesn't mean you *have* to make that change as it's just a recommendation.