i am using an apache webserver on debian, handling 12 different websites. Two days ago i suffered an attack and a hacker uploaded a php shell thru ftp in one of those 12 sites.
What i'd though about this shell, is "bah, this only can access to the www/ folder, he cannot go back" but here's the problem, with that shell he could acces even into the / folder and see all the folders-documents he'd want to (mailq, users, all websites files...), he could navigate around ALL my vps watching all documents and its content (not modifying them!), without modifying them.
I've been thinking these last days about it and i suspect is a www-data permission issue or something like this, but couldn't find any solution.
So how could i make that if i navigate on site1.com (at my vps) i'd be using a user that only could access to that directory?
In any words, if a hacker uploads a php shell again, i want him not to look at the rest of the documents behind /var/www/site1.com/www/