1

I'm considering setting up an AWS micro-instance from which I can run a number of different, unrelated websites.

An issue I've had with my shared hosting is that some of my clients run Wordpress sites which sometimes don't get updated to the latest version as promptly as I'd like, leaving them vulnerable to security vulnerabilities. Previously, when one of these Wordpress sites has been compromised all other sites on my shared hosting have been affected, including non-Wordpress sites.

I'd like to at the very least contain this if it happens again. Is there a way, on a single Linux instance, that I can have multiple PHP "users" (using the term very loosely) each with permission to read and write no higher than the website's root-level directory?

I've seen suggestions for OpenVZ but this seems like it would be a big performance impact for little gain.

Apologies if this has been asked before - it's one of those things that's difficult to phrase succinctly enough for a Google search but obvious enough that someone must have asked the same thing before.

1

You can use file permissions to isolate things on a single virtual machine (EC2 instance). You can have separate PHP pools, and they can run as different users according to this DO tutorial. That tutorial is pretty much a guide to exactly what you need to do, and is probably going to be better than using ECS.

You should be looking at t2 instances, t2.micro might be a little small with multiple pools, but a small or medium could work for you. You'll of course have to do some testing. You can add virtual memory to EC2 instance, but there are downsides, especially since the disk is across a network on t2 instances. Other instances types have local disks, the previous generation M3/C3 instances, but you're probably best off with t2 or current generation instances with enough RAM.

Alternately look at the AWS EC2 Container Service, aka managed docker. That will let you keep things completely separate, at the expense of running multiple copies of resource intensive apps like PHP, which uses a ton of memory. A micro instance probably wouldn't cut it for many containers, but a t2.large or similar is likely suitable.

Update - follow up questions Nginx is a fast, efficient web server and reverse proxy, that uses very little memory and is relatively easy to configure. Apache is larger and does more with the many modules available, but uses more resources.

I host 5 websites and MySQL on a t2.nano, but I occasionally run out of RAM doing a big yum update. A t2.micro is probably fine for you initially, but it depends how many PHP pools you have - they can be quite memory intensive. I have a guide on how to configure MySQL to use minimal RAM. Start with the t2.micro and the RDS service, both on the free tier, that way your database runs on a separate machine, saving RAM. Don't be surprised if you have to go up to a larger instance size due to RAM requirements.

Update from comment @tero Kilkanen points out the following very valuable point

If you want more separation between PHP workers, you can consider using the chroot feature of PHP-FPM. With chroot, each PHP process can see only access the directories in its chroot. However, it needs much more work to set up and I don't know if there are any guides to do that

  • Thanks a lot. Is nginx as the HTTP server in that guide relevant? I'm not locked to Apache in any way so can easily switch. I was thinking of starting with a t2.micro as that's in the free tier. Is it easy enough to move up to small or medium if micro's not cutting it? – Michael Feb 19 '17 at 21:04
  • @Michael see my updated answer above – Tim Feb 19 '17 at 21:10
  • Massively appreciated. Thanks. I will accept this but I'll leave it open a little while longer first. – Michael Feb 19 '17 at 21:20
  • 1
    If you want more separation between PHP workers, you can consider using the chroot feature of PHP-FPM. With chroot, each PHP process can see only access the directories in its chroot. However, it needs much more work to set up and I don't know if there are any guides to do that. – Tero Kilkanen Feb 20 '17 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.