I've a peculiar situation. I've VPS that I use for my own projects. A friend of mine asked me to host his wordpress blog.
Now I've setup my VPS very straightforward, all projects are under /www and apache has write access to these folders (www-data), I'm on ubuntu server 12.04.
Mysql side there is no problem, this wp installation has its own DB/username-pass that has access to only this DB.
But I'm worried that if his wp-admin password gets compromised, security of my VPS can be compromised too.
I'm thinking to chown /www/projectX to me:me. And give write permission only to plugins and image upload directories. But if everything runs under same apache user, potentially hacker may upload malicious script to those directories and thus get access to my other projects on the server.
Is there anything I can do to safeguard myself? at least partially?
I don't want to secure this particular installation of WP, I want to secure my other projects from this wp installation.