Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am running some Wordpress blogs for friends/family on a linux box and I would like to prevent the compromise of one from being able to inflict damage to all. It hasn't happened yet, but one of the bloggers installs every add-in and theme she can find, one of them will inevitably contain a vulnerability--it's just a matter of time.

I am using the stock Amazon Linux Apache/PHP install so I basically have a bunch of preforked apache processes all running as the same user and the application directories are all owned by www-data. What I would prefer is for all installations to run as different users, but I would like to avoid having to dork with FastCGI. Is it possible to be isolate in that manner when using mod_php?

Edit: If there is a solution to that problem that doesn't involve separate uses for each directory, I am also fine with that. Any technique that works will be appreciated.

share|improve this question

1 Answer 1

Virtual Machines are the key. Separate everybody or everything in it's own VM.

share|improve this answer
    
These websites aren't busy enough to warrant that, would appreciate another solution. I just need to isolate them to a reasonable degree. –  Joel Clark Dec 3 '11 at 19:06
    
@Joel This is like "I want ice cream but not too cold". Either you want isolation or not. You are already afraid of compromising the machine. A compromised machine affects all websites independent of their theoretical isolation. –  mailq Dec 4 '11 at 11:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.