3

What are some of the security risks involved with using shared hosting services such as godaddy inmotion and fatcow?

1
  • What are you afraid of?
    – SLaks
    Apr 23, 2010 at 18:59

3 Answers 3

3

I worked as a sysadmin at a hosting company and there can be many issues related to security to consider.

I think a self-managed dedicated server is great IF you know what you are doing. If you are willing to maintain the software packages installed and run regular security updates, etc, and you don't need admins to help set things up. If part of the reason you are hosting is to tap into someone else's expertise, then go shared/VPS/managed dedicated.

Otherwise you really need to ask the host (you can ask them and get a quick response, right?) about their server software versions and update policies.

A good host should be on top of all the software running on their boxes and provide rapid response (with testing) to apply security updates.

You should run from any host that is not using currently maintained software or operating systems, or is not able to provide you with quick responses about their server software update policies.

Also, a good host should have users isolated from each other via proper server configurations of PHP and Apache. On a decent host, this shouldn't even be an issue.

And this doesn't even touch the security issues with whatever Forum,CMS,Blog,etc.. software you are going to run.

2

For one thing, a lot of shared hosts have it setup so other users can access your home directory if you aren't careful to chmod your files. Secondly, you are putting your full trust in the shared host owner, they are usually incompetant IMO, and I'd never trust one, maybe a huge host like GoDaddy is okay, I remember last time I've seen a Hostgator shared server it was running a vulnerable kernel and everyone had access to each other's homedir.

1
  • +1 for the file permission warning. Unix file mode and ownership are a bit too flexible for an hosting environment where the users don't need to exchange files or anything. Apr 24, 2010 at 17:49
0

There is always risks with shared hosting, and even virtual root servers. Take for example:

Quite recently the Kloxo/HyperVM Virtualization software got exploited, and a LOT of people lost all of their data on a host, www.santrex.net. Probably other hosts as well, but I had a few virtual servers with Santrex, and their Xen Virtual Servers STILL aren't back up. It's been two weeks.

Shared hosting has the same problems, respectively.

If you're worried about security, you need to go with a dedicated server so you know all the software being run, and so that you maintain total control over all of it.

2
  • To be fair, the issue with Kloxo was an appallingly naïve admin-webapp rather anything to do with the virtualisation as such. Providers' admin webapps gone wrong can bite you even on dedicated hosting! Sure, guest-to-host virtualisation exploits have happened, but relatively rarely; virtual root remains hugely better than shared hosting where you have very little security. @Rob: Santrex were still running HyperVM, in 2010? Jeez... that's just depressingly incompetent.
    – bobince
    Apr 23, 2010 at 21:24
  • Yeah, they're just now switching to some FluidVM. What would you suggest?
    – Rob
    Apr 25, 2010 at 1:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .