1

Basically I control several servers and I only host either static websites or scripts which I have designed, so I trust them up to a point.

However, I have a few customers who want to start using scripts such as Wordpress or many others - and they want full control over their account.

I have started to do the basics - like on php.ini, I have locked it down and restricted commands such as proc, however, there is obviously a lot more I can do.

right now, using NTFS permissions, I am trying to lock down the server by running Application Pools and individual sites in their own user, however I feel like I am hitting brick walls... (My old question on Server Fault).

At the moment, the only route I can think of is either to implement an off the shelf control panel - which will be expensive and quite frankly, over the top, or look at the Microsoft guide - which is really for an entire infrastructure, not for someone who just wants to lock down a few servers.

Does anyone have any guides that can put me on the correct path?

1
  • If someone can please create/edit in the iis tag... I didn't want to use iis7 as this is for both iis6 and iis7 as I have a few 2003 servers. Nov 10, 2010 at 21:47

1 Answer 1

0

First, I'm making some assumptions, so please excuse me if I missed the point of your question. I'm assuming that you are providing some web hosting services for some of your clients, and now they are asking for control over the web host, as opposed to you doing all the work for them.

Two words: virtual machine. Don't give them access to your host web server. Let them have full control of a VM instance - if they muck it up, your more valuable host is not harmed or tampered with - only their sites & services. Then you can give them administrative control over the instance and not have to worry about it (except for backups of their initial instance - but that depends on your contract with your clients). They'll also feel more special when you give them an administrator account. :-) I highly recommend this path if it is at all possible for you.

If that's not an option and you're OK with sharing your host system with your clients, I would then suggest partitioning one of your disk arrays such that your client has their own volume to host their sites and data from. You could create a base directory for them within your own , but then you have to muck around with NTFS permissions and inheritance, which, depending upon the complexity of your file system, could get ugly.

If it's an option, it's much simpler to create a new volume/partition - with their own volume to use, security will be much, much simpler as you could give them full control over the volume, and you can assign disk space limitations as well so they can't fill up your disks and bring your system to a halt.

I think you're on the right track with the separate application pools and separate sites. You may want to look at this article on the delegation of rights to manage sites and applications (iis7). It'll get more complicated if they start using databases - however, if all they want to do is host some static content, the above should keep them from running amok.

5
  • Many thanks - but just to start with licensing, this is financially not possible :( VPS hosting is something that I offer in addition, and it works great, but I am looking for a guide to set up shared (isolated) hosting like other web hosts use. I know it is possible, but I just can't get it to work (e.g. that link to a previous question I have in my question), there just seems to be pitfalls and unforseen security holes - e.g. in asp script, I can browse the entire hard drive despite the user being not much more than a guest... Nov 11, 2010 at 12:10
  • ... I am sure I will get there, but it will just take me a while. MS offer guides and solutions, they are just designed for a new many server infrastructure and not for someone who just wants to use a few servers for hosting. Nov 11, 2010 at 12:11
  • @Wil - when you say "shared" hosting, do you mean something such as the old angelfire type of hosting: wilshostingservice.com/customera and wilshostingservice.com/customerb - that sort of thing? How will the customers obtain access? Just SFTP/FTPS? Are you trying to provide some sort of administrative control as well?
    – Cypher
    Nov 11, 2010 at 20:54
  • I am talking about bog standard modern "shared hosting" en.wikipedia.org/wiki/Shared_web_hosting_service - As I said, I already do it, just looking on a way to secure it!... Shared hosting is just many people on one box, it does not just mean site.com/customer, it is everyone with their own domain(s), all hosted in IIS. It is what pretty much every host offers - they do not use a VPS for every customer. Nov 11, 2010 at 21:56
  • @Wil - Thanks for the clarification. I'll take a look at the wiki and see if I would be able to provide more insight. Most of my experience has been with dedicated hosting (virtual or otherwise), but I may be able to help. In the meantime, does the link above regarding "delegation of rights" help in regard to securing IIS?
    – Cypher
    Nov 11, 2010 at 23:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .