Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I'm providing a partial web hosting solution where my clients may upload and execute their own php scripts.

Besides the security routine I'll have to check (off topic here) I would like to know whether it is possible for me to prevent my clients to setup an "attack basement" in there?

I believe that I can't do much except making them sign some policy acceptance...

Also, since there's only a few IP shared by all the hosts, would there be a risk of everyone getting banned?

share|improve this question

marked as duplicate by HopelessN00b Feb 18 at 6:02

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

Proper isolation between clients along with some restrict resources limitations would be the answer.

IN/OUTBOUND traffic (as suggested by voretaq7) , CPU, memory, disk usage, and disk IO are of the keys to achieve this. How to do it may vary according to the hosting solution you're using..

share|improve this answer

If you let people execute arbitrary code in an unrestricted environment there is very little you can do to make it "secure" -- When I worked for an ISP that provided shared hosting with PHP we mitigated this by only selling to companies/individuals we had vetted to some extent to ensure they weren't J. Random. Haxor looking for a platform to launch attacks from, and honestly that's the best solution to this problem.

Beyond that you can restrict outbound network access (either with PHP settings or through a firewall - the latter being preferable).
This may frustrate legitimate users, but it will also prevent malicious users from launching attacks from your server.


Note that this only addresses OUTBOUND attacks - As you noted there are other things you need to consider to adequately protect your server itself. That would be an interesting follow-up question.

share|improve this answer
    
yes you're right, I really have plenty of work to ensure my client's data security. But I'm on it! :-) –  Sebas Mar 16 '13 at 23:26
    
What could you do from php to limit outbound attacks? I'm curious –  Sebas Mar 16 '13 at 23:29
    
@Sebas Judicious use of disable_functions is usually about all you can do (this site has some suggestions but I wouldn't say it's a complete list) –  voretaq7 Mar 17 '13 at 5:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.