Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am going to host a few small sites on VPS, and each of them are going to run my own custom PHP scripts. I am fairly certain that they are secure (did everything in the book, plus some of which is not in the book) to make sure they can't be exploited. But just to be safe I want to know how I could secure each of the virtual hosts so that they can't escape from there virtual host (if a hacker uploaded a shell they could not go above the www folder a legitimate user can't do in ftp no matter how many times they click ..) folder on Debian and Apache.

share|improve this question
add comment

2 Answers

  • Use Suhosin and configure it appropriately.
  • Use SuPHP to run each script in a different user context. Bonus points for chrooting the scripts, but that means a lot of management overhead for creating and maintaining the chroot environments.
  • Read the Securing Debian Manual and configure your system accordingly.
share|improve this answer
    
Thanks, I was thinking of chrooting but as I thought it would be a lot of work. Is suhosin a popular choice amongst system admins? I thought there would be a more built in option for something like this like making a new user for each directory and have him locked in there without chroot? –  Dr Hydralisk Jun 13 '10 at 8:02
add comment

You could run each one as a different user and use suexec. This is painful, and means php cannot run as mod_php, but instead has to run as a CGI script.

Otherwise, I think it's rather difficult to 100% ensure that a security hole in one script cannot interfere with another using PHP.

share|improve this answer
    
Ill Google it and see if it fits my needs. –  Dr Hydralisk Jun 13 '10 at 8:13
    
fastcgi will reduce the pain: fastcgi.com/drupal/node/5?q=node/10 –  gbjbaanb Jun 13 '10 at 14:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.