Its questionable that you have a control panel that believes such a configuration is suitable for virtual hosting since an attacker can write to the folders it finds.
A quick way of helping here is to set chmod 711 on /home, this will prevent browsing of the folders -- however this is not a long term option because this is security through obscurity only.
To prevent writing to other users directories you would need to remove all affected users from the apache group and ensure that the permission set of the directory being used permitted only r-x for apache. That you can do using the 'everyone' bits on the server, or more suitably the setfacl command can permit apache only read and execute access to the specific folders..
setfacl -Rm apache:r-x /home/vhosts/*
setfacl -Rdm apache:r-x /home/vhosts/*
When it comes to preventing browsing/reading it gets a little more difficult.. a common option here is to use a setuid helper to alter the ownerships of files being executed say with PHP (this is thorugh an application called suPHP). This allows you to set complete ownership of the directories to the affected user. Apache upon executing a PHP file will switch ownerships to the owner of that file. For this to work you need to permit still at least 711/600 for directories/files apache wants access to.
Whilst this works, it comes with its own problems:
- It permits an attacker r/w access in the folder they attacked.
- The attacker can still browse out and attempt to read files and folders other people marked 777.
- The attacker gains the privileges of the user they are attacking which is worth more than a normally limited apache account.
- Execution has to be acheived via CGI which may not be ideal.
- suPHP often has its own setup or maintenance problems that need to be addressed.
RHEL6 has some better support to address this problem by utilizing mod_selinux. It should fix the problems above, offer a higher level of security overall and allow you to be informed of a breach immediately.
SELinux on its can help confine an attackers options by reducing the attack surface and/or by alerting you by tripping over a permission denial. But mod_selinux allows you to use the categories system of selinux to define unique credentials for each virtual host.
You can install the package using yum, then in the mod_selinux.conf file in httpd/conf.d alter the line:
Finally in each virtual domain add:
Where X differs from virtual host to virtual host.
Finally, finish off by altering the categories of each /home/user folder to the relevant one setup inside of the http config.
Now, an attacker whom attempts to spawn a shell has a much more difficult problem reading into the other virtual hosts! Not only this but most shells will not spawn correctly (or backshells) as the standard selinux policy prevents it. It will also alert you (typically setup to email you on a server) to the breach so you can immediately trace the problem.
Edit: setfacl should say r-x now rwx