Chrooting, a technique commonly used with MySQL at the file system level, is typically achieved by creating a separated and minimal operating system disk-image to improve system and application security by providing them with a higher degree of isolation. Thierry Manfe has written a how-to that goes a step farther, utilizing the zone and Crossbow virtualization technologies that come with OpenSolaris to get to the next level in terms of isolation.

With this approach, Manfe writes that he can cap the physical resources (RAM, CPU) that an application is allowed to consume isolate the application not only at the file-system level but also at the network level by having the zone use its own virtual NIC (vnic), that in turn has its own mac and IP addresses. The vnic bandwidth itself can also be capped, Manfe writes.

The article illustrates both the instance just mentioned and the strengthened network isolation that results from having the application on a separated virtual network. Manfe notes that Crossbow provides better defense against denial-of-service (DoS) attacks, virtualizing the network stack and NIC around any service (HTTP, HTTPS, FTP, NFS, etc.), protocol or zone.

Each virtual stack can be assigned its own priority and bandwidth on a shared NIC without causing any performance degradation. This architecture protects against attacks directed at a particular service or virtual machine by isolating the impact just to that entity. More details about Crossbow features can be found here, Manfe explains.

The steps in Manfe's process includes the following:

• Creating a Virtual NIC for the Chrooted Environment
• Creating a Zone to be used as a Chrooted Environment
• Configuring the Zone OS
• Installing MySQL
• Moving to a Complete Virtual Network
• Re-configuring the Zone OS

Screen shots and code samples accompany each of the stages.

More Information

MySQL Performance in Virtualization Environment on xVM Hypervisor

Some Best Practices for Secure Use of MySQL on the Web

Virtualization for MySQL on VMware: Best Practices and Performance Guide [...read more...]

		fullsource
Print Email Current Profile Archive Blog Generate newsletter