Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running some Wordpress blogs for friends/family on a linux box and I would like to prevent the compromise of one from being able to inflict damage to all. It hasn't happened yet, but one of the bloggers installs every add-in and theme she can find, one of them will inevitably contain a vulnerability--it's just a matter of time.

I am using the stock Amazon Linux Apache/PHP install so I basically have a bunch of preforked apache processes all running as the same user and the application directories are all owned by www-data. What I would prefer is for all installations to run as different users, but I would like to avoid having to dork with FastCGI. Is it possible to be isolate in that manner when using mod_php?

Edit: If there is a solution to that problem that doesn't involve separate uses for each directory, I am also fine with that. Any technique that works will be appreciated.

share|improve this question

Virtual Machines are the key. Separate everybody or everything in it's own VM.

share|improve this answer
These websites aren't busy enough to warrant that, would appreciate another solution. I just need to isolate them to a reasonable degree. – Joel Clark Dec 3 '11 at 19:06
@Joel This is like "I want ice cream but not too cold". Either you want isolation or not. You are already afraid of compromising the machine. A compromised machine affects all websites independent of their theoretical isolation. – mailq Dec 4 '11 at 11:43

Yes it is possible. If you don't mind the speed hit, you can use MPM ITK to run each Apache as its own user (you'll need to set the proper filesystem ownership and permissions on each site's main directory so that other users can't get into it). That will allow you to still use mod_php. Be sure to read the "Quirks and Warnings" section on its homepage though ( and make sure the pros outweigh the cons in your case.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.