Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I read a lot about if someone gained access to one of my websites then they should be jailed into that website. I understand what this mean although not sure how to achieve this.

I have a debian web server running multiple php/mysqli websites set up with vhost.

share|improve this question
up vote 3 down vote accepted

How "jailed" is jailed enough? Running each "site" in an own webserver with a single database server then you can probably break the jail through the database server.

Separating each site also in separate processes for database and webserver there is a small chance to break the jail through the operating system. That said leads to the question if it is the best way to have each site in an own virtual machine.

But couldn't you break the VM jail through the VM host?

So it is only a question of how secure do you want it. And how much time you want to spent making your environment secure. Where 100% security is never possible though.

share|improve this answer
Very interesting some points I had not thought of and will be addressing. – John Magnolia Aug 13 '11 at 13:31

The solution more simple for your problem is the system-level isolation. In Wikipedia exist a table with the different technologies.

Only a warning. If anyone access to site1 because your software is vulnerable, also will access to site2 with the same vulnerability. The isolation will not protect you in this case. This technique only protect you of vulnerabilities of your custom web code.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.