So your main concern is that compromised one account cannot do anything bad to other accounts.
PHP and file permissions
If PHP is configured to run as different user for each domain, then your directories should set-up such that it doesn't have write access to anything outside its own domain. Then using PHP (or any other commands invoked via PHP) it can't do any harm to rest of the server.
Best practice is to have the scripts be owned by user1, but PHP to run under user2. For customer access, FTP should be configured for user1. User2 should be given write access only to specific directories where really needed (cache dir, generating thumbnails, file uploads via PHP).
But many people start to install Wordpress and other CMS, don't know what to do and give write access to everything (then badly written CMS plugin can compromise all php scripts for that domain). Wordpress and other CMS nowadays support install/upgrade even without write permissions for the PHP process (they just ask for FTP login and automatically use it).
Another best practice is to block direct web access to those directories where user2 has write access. File uploads should be checked by your script, and only if valid, moved to directory accessible from outside (otherwise someone can upload PHP script instead of JPG image and could fool your webserver to execute it).
Apache
Use Apache's AllowOverride None
directive to disable usage of the .htaccess
file, so that attackes cannot configure running of other CGI scripts. Apache should have only read access to the served files (PHP config files containing passwords don't need read permissions for Apache). With .htaccess
disabled, user has no means of changing the Apache configuration.
Use Options -FollowSymLinks
(or -SymLinksIfOwnerMatch
) to prevent the symlink "attack".
Install mod_security
to watch for suspicious activity and block hacking attemps like SQL injection.
EDIT: If .htaccess
is needed, you need to decide what options your hosting will support and enable only those. Examples of commonly used options which are safe include (list them in AllowOverride
):
- AuthConfig - to enable Basic HTTP authentification
- ErrorDocument - to define own URL instead of default for 404 response (as you are defining URL only, only already accessible content can be used, so no risk)
- Indexes - if you want to enable plain directory listings
- Limit - to limit access by IP address (usually used by the
Deny from all
directive to deny access to part of the dirs)
- RewriteEngine, RewriteOptions, RewriteBase, RewriteCond, RewriteRule - for mod_rewrite
- SymLinksIfOwnerMatch - needed for mod_rewrite (its documentation states that it needs
FollowSymLinks
, but it seems it works also with this one); besides mod_rewrite use, Apache would only follow the symlink if the destination file/dir is owner by the same user as the symlink itself.