On Linux do people chroot a Java Web Application or use IPTables and run as non-root?
- by Adam Gent
When you run a Java Servlet Container that you would like to serve both static and dynamic content on port 80 you have the classic question of whether to run the server as:
As root in hopefully a chroot jail if you can (haven't gotten this working yet)
As a non root user and then use IPTables to forward port 80 to some other port (1024) that the container is running on
Both: As a non root user, IPTables, and chroot jail.
The problem with opt. 1 is the complexity of chrooting and still the security problems of running root.The problem with opt. 2 is that each Linux distro has a different way of persisting IPTables. Option 3 of course is probably idea but very hard to setup.
Finally every distro has the annoying differences in daemon scripts.
What do people find as the best distro agnostic solution and are there resources to show how to do this?
