Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm curious how VPS accounts work. I know my shared hosting provider can look through my files since they've changed things in the past. If I purchase a VPS account, like from Linode or Slicehost for example, would the folks there be able to see my clients' files I've hosted inside my VPS account? Or would they need an authorized ssh key to do so?

share|improve this question

4 Answers 4

Ultimately there is nothing keeping them from accessing your virtual server's disk. If you are using something like Linode or Slicehost then they wouldn't do it by logging in as root unless you gave them the password. What they could do however is shut your VPS down and then mount the virtual disks on the virtual machine host. At that point all the files on your virtual server would be accessible to them. Another way of thinking about this is that if you had a physical server you leased from someone they as well could shut the server down, remove the disks and stick them in their own server to get access to what the disks contained. A VPS just makes extracting the "drives" easier.

share|improve this answer
2  
Don't forget, however, that it is very unlikely that a large, reputable provider such as Linode or Slicehost would do this without permission. –  fahadsadah Jan 31 '10 at 8:46

Depending on what they're using for the underlying storage infrastructure they might also be able to take a live snapshot of your virtual disk and mount that separately, without having to take your server down. About the only way to guard against this is to use a disk encryption system such as TrueCrypt or the encryption support built into the OS. This has the major downsides when it comes to managing the key to unlock the encryption - you've got to be very paranoid to make it worthwhile.

share|improve this answer

It's pretty much as Carson says but even easier - Shut down the machine and copy the VPS drive or image the real drive. This reduces the down time considerably. Of course with virtualisation technology, such as is used by a VPS they can take a snapshot while the machine is still running, so it's highly unlikely that you would ever even notice it had been done.

share|improve this answer

I had a VPS with a company using the Virtuozzo platform and they were able to access the server without the root password. I queried them about this and they indicated that such access is not possible with platforms based on Xen or VMWare.

If you're really paranoid, you could set up your VPS with a second virtual disk to contain your data, and use full disk encryption on it. You'll lose the ability to reboot it without requiring manual intervention to supply the decryption passphrase, but it also means snapshots of it will be unreadable without the passhprase (which you won't store on the server).

The only way for them to access your files would be for them to break into the server instance whilst it's running, and I don't think they'd have any special way of doing that.

share|improve this answer
2  
First, your provider misinformed you. Perhaps that's because they didn't know any better. Second, I can think of a few ways to access a running VM instance, having control of the host. None are outside the capabilities of most senior sysadmins. I can just pull your decryption key right out of memory, for instance. –  Michael Hampton Feb 13 '13 at 4:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.