Safely granting users apache/php access?

Question

Running a linux server. We want to give many users access to test/play around with php and apache and do things with it. I want to know what the best method would be to:

1. Prevent users making infinite loops that can crash the server due to ram/cpu usage

2. Prevent access to subdirectories from php

3. Same effect with apache

The issue is that I am looking for a plugin (or anything) to do this on a user level rather than a process level (I've seen a bunch of php.ini/.htaccess solutions but they seem to focus on processes rather than uses (like the php's max_execution_time).

Anyone know of any addong/plugins/or other ways to detect and limit the potential for damage done by users on a linux server?

Answer 1

The best way to do this is to run absolutely everything that the user can control as the user, then put strict limits on what the user can do. This means you run all code with suexec or suPHP, and use ulimits to keep the number of open files, subprocesses, memory used, and so on to a reasonable level. Add proper permissions management to keep prying eyes out of places they shouldn't be, disk quotas for avoiding disk full problems, a good monitoring setup to detect when things are going bad so you can investigate, and a strong ToS that allows you to happy-slap anyone who does something malicious, and you'll have a reasonably straightforward time of it.