Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We want to setup a shared webserver running Apache2 and PHP5. Our need is to host some PHP apps like Wordpress, Zend framework applications... Some of the sites may be controlled by external developers, so we need the security to be high.

We will like to run with php safemode = Off, because of the problems running ie. wordpress in safe mode.

How do we secure the access/permissions from the php-application to rest of the server? (How to secure that PHP-cade, can't access webserver config-files, logs etc.)

How do we secure the access/permissions between two sites? (How to secure that one site can't access files/data from another site)

We have considered taking advantage of the mpm-itk combined with open_basedir, but is it enough?

Is there a suggestion for the access rights on the servers filesystem?

What about disabling some functions like system(), exec() etc.?

share|improve this question

2 Answers 2

I'm using the peruser MPM with separate users/groups for every shared virtual host on the server. These users have restricted home directories (700) and separate directories for session files. I've patched PHP with suhosin and added the security-related directives (like open_basedir) to php.ini.

Keep in mind that with shared hosting configuration you can never be "fully" secured.

share|improve this answer
    
Thanks Georgi :) –  Jacob Bach Pedersen Jan 24 '12 at 13:37
    
Is it correct that mpm-peruserand mpm-ITK only secure the access between the different vhost and not the safety for rest of the server? So they could still access all the configs ect. on the server? To secure that, we need open_basedir? –  Jacob Bach Pedersen Jan 24 '12 at 13:58

If you want a secure server, don't run Wordpress and don't run code written by external developers.

But since that seems to be a basic requirement, then in addition to all the usual things you should do in setting up a secure http server...

open_basedir is a good start. But if you've only got 2 sites to seperate why not just put them in their own VMs on the server? Or run 2 instances of the webserver as different uids with a common reverse proxy?

You certainly want to very focussed on your egress filtering. And definitely have a look at suhosin if you plan to go down the single webserver route.

share|improve this answer
    
its about 30 sites so I think a VM solutions is not possible. –  Jacob Bach Pedersen Jan 24 '12 at 21:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.