Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am working on a scenario if we have two or more web application hosted on a same server. Let says Web application X is vulnerable so how can i be sure that it will not effect the other web application Y. In short my question how can I isolate web application hosted on the same server ? What are the techniques that need to be in configured on the web server ?

share|improve this question
1  
This depends on the web server that you're running, the preprocessors you're using, and the OS for the system. Outside of VMs a little more background on the problem is needed to provide a better answer. (eg splitting sites with Tomcat on Apache on CentOS is different than splitting a php site from cold fusion site under IIS in Windows Server) –  AbsoluteƵERØ May 17 '13 at 18:49
add comment

2 Answers

up vote 6 down vote accepted

If you have multiple websites on the same server then depending on the issue, a security problem with one site may well affect another.

Mitigating this essentially means increasing the separation between the two applications. You could do this by using somthing like a chroot jail or if that's not enough isolation you could look at using VM guests on the same host to provide more isolation.

share|improve this answer
add comment

There are various levels of protection you can use. The most basic would be to configure them as separate sites running as different users and only allow each site's user access to the assets it needs. At a basic level, this should prevent one site from being able to access the other.

There are still some attacks that may be able to escape this though (if for example they are able to escalate privileges). To offer further protection, you can do something like running VMs for each of the sites that will further sandbox each site. There are still some theoretical ways to escape a VM, but you'd be very well protected at that point but also would have far higher resource demands (since two additional kernels would have to be running).

There are also a few other levels you could do in-between that attempt to do a sandbox isolation without actually doing a full VM, but I don't know much about those techniques or their effectiveness. Personally, for all the sites that I have run, simply properly configuring users and only allowing each site access to it's own assets (and keeping the server patched) has been sufficient for my needs.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.