3

I have been administering a few LAMP servers with 2-5 sites on each of them. These are basically owned by the same user/client so there are no security issues except from attacks through vulnerable deamons or scripts. I am builing my own server and would like to start hosting multiple sites. My first concern is... ISOLATION. How can I avoid that a c99 script could deface all the virtual hosts? Also, should I prevent that c99 to be able to write/read the other sites' directories? (It is easy to "cat" a config.php from another site and then get into the mysql database) My server is a VPS with 512M burstable to 1G. Among the free hosting managers, is there any small one which works for my VPS? (which maybe is compatible with the security approach I would like to have) Currently I am not planning to host over 10 sites but I would not accept that a client/hacker could navigate into unwanted directories or, worse, run malicious scripts. FTP management would be fine. I don't want to complicate things with SSH isolation.

What is the best practice in this case? Basically, what do hosting companies do to sleep well? :)

Thanks very much! David

Improve this question

6 Answers 6

Reset to default
1

You can use chattr +i against the deface part but it wont fix the php bugs. The typical php security features will help, in the worst case scenario chroot also possible.

http://php.net/manual/en/security.php

http://www.hardened-php.net/

Improve this answer
2
  • Thanks. I am sure a deface can't be avoided without secure scripts. What I would like to avoid is a mass-deface. So do you think I should not worry about clients running <?php shell_exec("ls /var/www/vhosts/notmysite.com/"); ?> ?
    – David C.
    Oct 21, 2009 at 11:46
  • how can you deface a site is all the files are immutable in that directory? php shell_exec is really bad stuff you can avoid it to use open_basedire and such security solutions. or as i said different chroot for each guy :)
    – Istvan
    Oct 22, 2009 at 9:14
1

Buy Your way out of the Problem:
Michael suggestion is to use VPSs, I agree with that, but I believe you said you have a VPS right now, that is probably either XEN or OpenVZ already. I have never heard of anyone nesting VPSs before.

So I would recommend virtualization for containing things too, but I think if you have a bunch of sites, you might want to rent a whole server, and run OpenVZ or Xen on it. Then put each site or groups of sites in its own container. If you are not worried about certain sites interacting with each other, put them in a container and use virtual hosts, otherwise give them their own virtual machine.

One thing about this method will be that you will probably want to get more IPs, which will cost a little more. You could maybe work something out with reverse proxies, but that is probably more trouble than it is worth.

So buying a whole machine, and some IPs, will probably cost you more. But I think that would be cheaper than buying the same amount of VPSs. Containing things within an os is tricky as you mentioned. So on the whole, my solution is just to spend a little bit more by leasing a server and getting IPs, but in the end I think it will make everything simpler for you.

Improve this answer
2
  • Thanks. For my current plans, I think one VPS for each site would be too much. What I am curious to know is what hosting companies do to host hundred sites onto one server without mass-defaces and other security problems :) Thanks! David
    – David C.
    Oct 21, 2009 at 13:22
  • You can nest OpenVZ within XEN because it is a different type of virtualisation based on containers. But it may be harder to do this when you rent a XEN vm rather than having it in-house.
    – Michael Dillon
    Oct 21, 2009 at 14:42
0

For this kind of application I would seriously look at OpenVZ which is virtualizes Linux systems. It is not a virtual machine system like XEN or Virtualbox because it does not simulate a CPU. Instead, it creates containers which isolate a set of Linux processes from other processes running on the machine.

Improve this answer
0

I would use mod_suexec in Apache and run all scripts as CGI. This allows you to set the user to run as in the virtual host definitions. You can then set each virtual host subdirectory to a different owner, but same group. Everything is group readable but only user writable. This doesn't completely prevent malicious viewing, but goes a long way.

So the Apache server runs as (using Debian's settings, as that's what I know) www-data.www-data, all the virtual host directories are set as group www-data, but a user based on the client.

As a note, the way I usually set up virtual hosts is with the following directory structure:

vhost1-root
    /html
    /scripts

You can have whatever else you'd like there, but Apache points to the html directory. Then, since suexec controls the user to use, scripts and anything else can be in a client-specific group, making them unreadable by other clients. Unfortunately, I haven't traditionally used suexec in the past, since I've always owned all the sites. But in general this structure has worked well.

Improve this answer
0

Check out ITK MPM for Apache 2.x: http://mpm-itk.sesse.net/

mpm-itk allows you to run each of your vhost under a separate uid and gid — in short, the scripts and configuration files for one vhost no longer have to be readable for all the other vhosts.

I am using it on a number of busy sites for a couple of years now, without any problems.

Moreover it is readily available in Debian-based distros as apache2-mpm-itk and should be available in others too.

There is also an older alternative, Peruser MPM, but it were prone to bugs and harder to configure last time I checked.

Improve this answer
0

Increase Apache Vhost Security With mpm-itk In RHEL/CentOS 5 http://blog.lystor.org.ua/2010/04/increase-apache-vhost-security-mpm-itk.html

Improve this answer

You must log in to answer this question.