Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm providing a partial web hosting solution where my clients may upload and execute their own php scripts.

Besides the security routine I'll have to check (off topic here) I would like to know whether it is possible for me to prevent my clients to setup an "attack basement" in there?

I believe that I can't do much except making them sign some policy acceptance...

Also, since there's only a few IP shared by all the hosts, would there be a risk of everyone getting banned?

Thanks for your opinions about that.

share|improve this question
add comment

2 Answers 2

Proper isolation between clients along with some restrict resources limitations would be the answer.

IN/OUTBOUND traffic (as suggested by voretaq7) , CPU, memory, disk usage, and disk IO are of the keys to achieve this. How to do it may vary according to the hosting solution you're using..

share|improve this answer
add comment

If you let people execute arbitrary code in an unrestricted environment there is very little you can do to make it "secure" -- When I worked for an ISP that provided shared hosting with PHP we mitigated this by only selling to companies/individuals we had vetted to some extent to ensure they weren't J. Random. Haxor looking for a platform to launch attacks from, and honestly that's the best solution to this problem.

Beyond that you can restrict outbound network access (either with PHP settings or through a firewall - the latter being preferable).
This may frustrate legitimate users, but it will also prevent malicious users from launching attacks from your server.


Note that this only addresses OUTBOUND attacks - As you noted there are other things you need to consider to adequately protect your server itself. That would be an interesting follow-up question.

share|improve this answer
    
yes you're right, I really have plenty of work to ensure my client's data security. But I'm on it! :-) –  Sebas Mar 16 '13 at 23:26
    
What could you do from php to limit outbound attacks? I'm curious –  Sebas Mar 16 '13 at 23:29
    
@Sebas Judicious use of disable_functions is usually about all you can do (this site has some suggestions but I wouldn't say it's a complete list) –  voretaq7 Mar 17 '13 at 5:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.