I'm about to setup a VPS that will host multiple websites of my companies that only I will have access to. These websites are our own sites and, therefor, it's my own code that will be running on the server.

So I'm wondering, should I bother separating sites with their own user/group to sandbox each site? Obviously, I won't be uploading a shell to one of the sites to read files from another site - I can just SSH in :>

But, I'm thinking in terms of if one of the sites gets hacked by someone else due to a vuln being found in a CMS/my code/etc. If I sandbox it off, then that one site gets hacked rather than all.

Should I bother with this?


Running websites sandboxed is always a good idea. But an important question that you need to ask is - are you & your clients willing to take the performance hit that comes from implementing suexec/suPHP?

I can't find a more recent article, but this 2007 post benchmarking suexec says it's about 30x slower than regular mod_php.

If your clients are running in mixed technology stacks (for ex., Perl & PHP are both required) you might want to consider the peruser MPM instead. The peruser MPM isn't part of the core Apache codebase, but it's listed on the official Apache wiki which would seem to suggest that the Apache foundation believes that this MPM development isn't going to disappear overnight.

Now if your clients are running just a regular LAMP stack (emphasis on the P) - you might want to look into PHP-FPM instead. It's a PHP-CGI implementation that provides native sandboxing, chrooting and many other customizations not offered by native PHP-CGI+suPHP. Plus, from PHP 5.3.3 PHP-FPM is part of the core PHP stack so you don't need to worry about compatibility issues.


Simple answer: yes, you should.

Separating different (logical) users on a system is always a good idea. By having individual users per site you could also enforce a file system quota or process restriction more easily.

Depending on the performance requirements and capabilities of your applications you could run your scripts through FastCGI rather than plain CGI (which SuPHP uses).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy