How to run multiple (mod_perl supported) OTRS on a single host

Jens Bothe11. Aug 2010 | Administration

Situation

Running multiple OTRS instances on 1 host is interesting and possible when using the so-called CGI mode. This means OTRS is compiled by the webserver each time you perform a task like sending an email, calling the Dashboard etc.

Apache’s mod_perl on the other hand makes sure the OTRS is compiled at Apache start-up and available at any time (See [perl] for more information). This improves speed by numbers and you don’t want to miss it.

The intersting point is now to have separate OTRS within Apache’s memory not accessing each others environment.

Options

multiple Apache instances

The first idea was to “simply” run multiple Apache instances with their own configuration and environment.

See [multipleApache] for an example setup.

chrooted Apache environments

Chroots (or jails in *BSD) provide the option to further (in fact really) separate the different Apache processes from each other.

See [chroot] for more information and [chroot1] for an example setup.

mod_perl’s +Parent separation

mod_perl provides a switch which:

Create a new parent Perl interpreter for the given VirtualHost and give it its own interpreter pool (implies the Clone option).
…
Remember that +Parent gives you a completely new Perl interpreters pool, so all your modifications to @INC and preloading of the modules should be done again. Consider using PerlOptions +Clone if you want to inherit from the parent Perl interpreter.

Discussion

The idea of chroot’ing the Apache is nice and interesting but here’s the big BUT:

——————–
Pros and Cons

• If apache is ever compromised, the attacker will not have access to the entire file system.
• Poorly written CGI scripts that may allow someone to access your server will not work.

• There are extra libraries you’ll need to have in the chroot jail for Apache to work.
  If you use any Perl/CGI features with Apache, you will need to copy the needed binaries, Perl libraries and files to the appropriate spot within the chroot space.
  The same applies for SSL, PHP, LDAP, PostgresSQL and other third-party programs.

(http://www.faqs.org/docs/securing/chap29sec254.html)
——————–

So we have to provide the complete Perl environment plus any possibly used binaries inside the chroot.
This can be done either by copying the directory structures or files or creating a symlink farm for update reasons.

I’m really not sure about the final effort and if it’s justified by the gained security level.

At the moment I will skip chroot/jail and multiple Apache processes for 3 reasons:

• it seems that Apache and mod_perl provide a way to have separate run-time environments for web applications
• both alternatives need a much higher effort by no clear advantage
• mod_perl’s +Parent directive is independent of the used OS so the same mechanism can be used on Debian GNU/Linux, XYZ-BSD, Solaris, Windows Server 2008

Example on a Debian Lenny using name based virtual hosts

(1) configure your Apache and OS the way you want to use the <VirtualHost> setting later on

Make sure there is a default <VirtualHost> in /etc/apache2/sites-enabled/000-default

Add the virtual server names to /etc/hosts

(2) install your OTRS instances

(3) reflect your system settings in each OTRS’

• scripts/apache2-httpd-new.include.conf
• scripts/apache2-perl-startup.pl
• Kernel/Config.pm

scripts/apache2-httpd-new.include.conf

Add a <VirtualHost> handler to the configuration
(make sure you add the necessary </VirtualHost> to the end of the file)
<VirtualHost *:80>
ServerName otrs-3
ServerAdmin webmaster@localhost

# agent, admin and customer frontend
ScriptAlias /otrs/ "/opt/otrs-3/bin/cgi-bin/"
Alias /otrs-web/ "/opt/otrs-3/var/httpd/htdocs/"
# if mod_perl is used
<IfModule mod_perl.c>
PerlOptions +Parent
# load all otrs modules
Perlrequire /opt/otrs-3/scripts/apache2-perl-startup.pl
...
<Directory "/opt/otrs-3/bin/cgi-bin/">
...
<Directory "/opt/otrs-3/var/httpd/htdocs/">

</VirtualHost>

scripts/apache2-perl-startup.pl

# set otrs lib path!
use lib "/opt/otrs-3/";
use lib "/opt/otrs-3/Kernel/cpan-lib";

Kernel/Config.pm

$Self->{Home} = '/opt/otrs-3';
$Self->{'LogModule::LogFile'} = '/opt/otrs-3/var/log/otrs.log';
$Self->{'LogModule'} = 'Kernel::System::Log::File';

(4) link the OTRS configurations to Apache

ln -s /opt/otrs-3/scripts/apache2-httpd-new.include.conf /etc/apache2/sites-enabled/otrs-3

(5) restart Apache

(6) make sure your DNS is resolving otrs-3 correct

Further reading

[perl]

http://perl.apache.org/

[multipleApache]

http://www.jasny.net/?p=13

[chroot]

http://en.wikipedia.org/wiki/Chroot

[chroot1]

http://www.debian.org/doc/manuals/securing-debian-howto/ap-chroot-apache-env.en.html

[+Parent]

http://perl.apache.org/docs/2.0/user/config/config.html#C_Parent_

Have fun,

Daniel

• 10