Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

Say I have http://www.foo.bar

and I let my registered members have their own subdomain like http://fred.foo.bar

what are the potential dangers there?

Lets say that each user can upload and download files via FTP to their subdomain document root.

assuming that they have the ability to upload PHP and javascript files, is there a way to lock these scripts to only their subdomain? will other members be in danger? will the server be in danger?

share|improve this question
1  
Depends on how you're giving them access to the machine and the directories and what they're running on it and... – Bart Silverstrim May 20 '11 at 13:16
well lets say you sign up, then you get ftp access to log:pass@bart.foo.bar which is locked to you subdomain folder. but what about executing scripts and php code? will that have any dangers? – s2xi May 20 '11 at 13:22
1  
Are you talking about setting them up with A DNS Subdomain that points to their own server, or are you thinking a virtual host or VPS solution, where you would give them the subdomain, and tools/services running on your same server? – Brian May 20 '11 at 13:32
virtual host, /var/www/vhosts/foo.bar/httpdocs is the main folder while /var/www/vhosts/foo.bar/subdomains/{subdomainname}/ is the document root for each domain – s2xi May 20 '11 at 13:35

4 Answers

up vote 0 down vote accepted

Yes, if you let people run random PHP scripts or other CGI scripts/executables, they can use those to do all sorts of things on your server. Assuming a Linux server, the first thing you should do is make sure that every user's directory is accessible ONLY to its owner and to the group of the webserver and then ensure that the webserver is configured to run all PHP scripts and other CGIs through something like suphp/suexec so that they execute as the user who owns them, instead of executing with the webserver's permissions. Otherwise, if the users' files are world readable, then any PHP script can read them too. If the PHP scripts are run as the webserver, then the PHP scripts can read or write to any file that the webserver can read or write to, and that may include other people's scripts.

Protecting the users from each other is only the first step. Protecting the server from the users is the next, and requires a lot more work and continuous vigilance. For this, setting quotas (to keep users from filling the drive) and auditing permissions on things the users should not have access to would be just the beginning.

share|improve this answer
up vote 5 down vote

Simply speaking: your domain may be grabbed by the FBI because some dude puts something on his site that is illegal.

Happened. Some weeks ago. FBI went behind child porn and seized domains... i think one of them was wnned by a provider (child porn in a subdomain) and had like 70.000 subdomains, which all went "dark" (showing a seized comment). Took 2-3 days to fix this.

share|improve this answer
well granted, lets assume thats the last of my worries, i'm more concerned if anyone can upload a PHP page or javascript page that can harm my server or other people on the server. – s2xi May 20 '11 at 13:31
@s2xi, yes if you don't secure your server. That's like asking if you car can be stolen from your driveway, yes, of course it's possible. – Chris S♦ May 20 '11 at 14:22
sorry to here your bad news... – Chopper3 May 20 '11 at 14:29
up vote 2 down vote

There's always a risk that someone can take advantage of a bug or gain privileged access, especially using a cleartext transfer protocol like FTP. The hazard mostly lay in your permissions granted to the user and how you sandbox each user in.

A blanket security checklist isn't necessarily applicable because we don't know how you're implementing this in the first place; the server OS, the server for content, how you're jailing them, etc.

And security is a process, not a checklist.

Really the only thing I could tell you is assume all your users are malicious, sandbox them as much as possible, check your permissions on subdirectories to grant the least privileges necessary and make sure you have good backups and a file checker that does checksums in place to check for malicious activity as well as a good update procedure in place to keep the latest patches applied. Beyond that there's not much detail to your question and the question is so wide that the topic can fill a book...

share|improve this answer
up vote 0 down vote

Since this is not mentioned already...

Some one may be able to convince a CA to issue a SSL certificate for the parent domain and not just their own subdomain.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.