I am going to host a few small sites on VPS, and each of them are going to run my own custom PHP scripts. I am fairly certain that they are secure (did everything in the book, plus some of which is not in the book) to make sure they can't be exploited. But just to be safe I want to know how I could secure each of the virtual hosts so that they can't escape from there virtual host (if a hacker uploaded a shell they could not go above the www folder a legitimate user can't do in ftp no matter how many times they click ..) folder on Debian and Apache.

  • Use Suhosin and configure it appropriately.
  • Use SuPHP to run each script in a different user context. Bonus points for chrooting the scripts, but that means a lot of management overhead for creating and maintaining the chroot environments.
  • Read the Securing Debian Manual and configure your system accordingly.
  • Thanks, I was thinking of chrooting but as I thought it would be a lot of work. Is suhosin a popular choice amongst system admins? I thought there would be a more built in option for something like this like making a new user for each directory and have him locked in there without chroot? – Dr Hydralisk Jun 13 '10 at 8:02

You could run each one as a different user and use suexec. This is painful, and means php cannot run as mod_php, but instead has to run as a CGI script.

Otherwise, I think it's rather difficult to 100% ensure that a security hole in one script cannot interfere with another using PHP.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.