Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I'm providing a partial web hosting solution where my clients may upload and execute their own php scripts.

Besides the security routine I'll have to check (off topic here) I would like to know whether it is possible for me to prevent my clients to setup an "attack basement" in there?

I believe that I can't do much except making them sign some policy acceptance...

Also, since there's only a few IP shared by all the hosts, would there be a risk of everyone getting banned?

share|improve this question

marked as duplicate by HopelessN00b Feb 18 '15 at 6:02

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Proper isolation between clients along with some restrict resources limitations would be the answer.

IN/OUTBOUND traffic (as suggested by voretaq7) , CPU, memory, disk usage, and disk IO are of the keys to achieve this. How to do it may vary according to the hosting solution you're using..

share|improve this answer

If you let people execute arbitrary code in an unrestricted environment there is very little you can do to make it "secure" -- When I worked for an ISP that provided shared hosting with PHP we mitigated this by only selling to companies/individuals we had vetted to some extent to ensure they weren't J. Random. Haxor looking for a platform to launch attacks from, and honestly that's the best solution to this problem.

Beyond that you can restrict outbound network access (either with PHP settings or through a firewall - the latter being preferable).
This may frustrate legitimate users, but it will also prevent malicious users from launching attacks from your server.

Note that this only addresses OUTBOUND attacks - As you noted there are other things you need to consider to adequately protect your server itself. That would be an interesting follow-up question.

share|improve this answer
yes you're right, I really have plenty of work to ensure my client's data security. But I'm on it! :-) – Sebas Mar 16 '13 at 23:26
What could you do from php to limit outbound attacks? I'm curious – Sebas Mar 16 '13 at 23:29
@Sebas Judicious use of disable_functions is usually about all you can do (this site has some suggestions but I wouldn't say it's a complete list) – voretaq7 Mar 17 '13 at 5:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.