up vote 0 down vote favorite
share [g+] share [fb]

I am running some Wordpress blogs for friends/family on a linux box and I would like to prevent the compromise of one from being able to inflict damage to all. It hasn't happened yet, but one of the bloggers installs every add-in and theme she can find, one of them will inevitably contain a vulnerability--it's just a matter of time.

I am using the stock Amazon Linux Apache/PHP install so I basically have a bunch of preforked apache processes all running as the same user and the application directories are all owned by www-data. What I would prefer is for all installations to run as different users, but I would like to avoid having to dork with FastCGI. Is it possible to be isolate in that manner when using mod_php?

Edit: If there is a solution to that problem that doesn't involve separate uses for each directory, I am also fine with that. Any technique that works will be appreciated.

link|improve this question
feedback

1 Answer

up vote 1 down vote

Virtual Machines are the key. Separate everybody or everything in it's own VM.

link|improve this answer
These websites aren't busy enough to warrant that, would appreciate another solution. I just need to isolate them to a reasonable degree. – Joel Clark Dec 3 '11 at 19:06
@Joel This is like "I want ice cream but not too cold". Either you want isolation or not. You are already afraid of compromising the machine. A compromised machine affects all websites independent of their theoretical isolation. – mailq Dec 4 '11 at 11:43
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.