Host's sys admins - can they view files?

Question

Just a quick question. When using shared hosting, can system admins (employed by the host) access your files and read your database connectionstring details? Can they also access your database, and view the files, without a connectionstring? I'm assuming there's a certain level of trust, but is this possible/common?

Thanks

Answer 1

Simple answer: yes. Encryption - does not work. After all, the connection string must be readable for the.... website ;) So, an admin always can get access to it.

Answer 2

Yes, unless you encrypt things with keys that the host does not have access to you always assume that the host can read everything you put on their server. That's a general rule for any server. Regardless of what permissions you set, the admin can always override them.

This does not speak to the ethics of the situation. That's why it's critical to go with a host you trust if you have sensitive data that you will be storing on their server(s). Trust should come from a lot of things such as a proven track record, documented processes and policies, and recommendations from other clients who are doing the same thing that you are.

Answer 3

You're asking questions that kind of have two components...is it possible? Yes. Much like your browser in "private browsing mode" now still has your web history traceable at the ISP level, your hosts holding your server(s) can see your data traffic (if it's unencrypted), and depending on the host arrangement if they have admin login to your server they could get into it (and if they really wanted to they could break into the server, but you should notice if you have monitoring software that your server went down...if you want to be paranoid, they could have stolen an image of the server to forensically analyze later out of your view).

Is it common? I would venture not, but I don't work for a hosting company. They probably have better things to do than sniff through your servers when they have hundreds or more clients and potential lawsuits and reputation damage if an ex-employee goes around talking about cool stuff they gleaned from XYZ corporation's servers.

But it's more than possible, especially if they're in the US and have a warrant from the FBI to get data on your company. If it's like libraries, they are told they have to turn over the data without informing you that they're doing it, or collect data traffic and turn it over without telling you. Encrypt everything and you make it much harder.

It's already done with law enforcement and cell phone companies (conversations and GPS data). Quite common there, but you're asking about server and data hosting, not telecommunications.

Answer 4

Anything which is shared has the possibility of being accessed by someone other then you ;

as far as hosting companies, as Bart have mentioned that they have loads of other jobs to do instead of sniffing through anyone's data ; but most of the theft in retail industry, computing industry is from the inside. so stay away of hosting anything which you do not want to share with anyone.

Answer 5

Bottom line is that they are the admins, it's their job to manage the server and the data on it, so they need access to it. You could try encrypting stuff, but you would only cause problems for yourself longer term. Worst case would be that if the host had to restore a load of data for you following a hardware failure, they may not be able to get it back. And you wouldn't have a leg to stand on as it would have been you who had locked them out.

Answer 6

First off, physical access is golden, with physical access to a system and enough time and effort, system administrators can gain access if they don't already have access. This affects situations like co-location (colo) services where a company rents space from the provider in a well-connected data-centre but provides and administers their own system. If malicious the only noticeable activity may be unexpected reboots, while the admin gains root/administrator access.

System administrators of virtual private servers, and shared web hosting have root of administrator access to the entire system. They need it to do their jobs. Now front-line call centre workers may not have administrator access, but a limited help desk type access for common tasks like password resets, etc.

Professional system administrators will not access other companies' web sites and data without purpose. Valid reasons include legal (i.e. law enforcement warrants, subpoena, writ) which may or may not include a secrecy order, technical including server configuration, upgrading, administration, log reviews, and computer / network security - looking for evidence of potential malicious users / attackers trying to gain unauthorized access.

That said, I've only seen co-workers abuse their access for premium content, primarily adult material. And there have been numerous cases of "revenge" unauthorized access of estranged spouses, partners, bf/gf that have made the press.

For the most part, it tends not to be a serious problem, but it does happen.