Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I host all my websites from a single VPN, and am about to sell some limited space of my Linode to a friend to host their new blog. It'll simply be another entry in Apache, and then a dedicated folder to that website which will contain all the Wordpress files.

My issue is with security. If someone manages to compromise his Wordpress blog, will my other sites on the same box be compromised?

What is the easiest way to prevent or make an effort to prevent any of the files in his website directory or anyone that gains access there, getting access to any of my other folders or files?

share|improve this question

migrated from serverfault.com Nov 20 '11 at 17:30

This question came from our site for professional system and network administrators.

2 Answers 2

up vote 1 down vote accepted

With the setup you've proposed there, yes. The only solution here is something like suPHP. If his website runs as the same user as your website, there is nothing that you can do to protect yourself. You need to set his website up as a different user, and ensure permissions on all the files are tight (0700 ideally).

share|improve this answer
    
Any tips on how I could get this setup? –  Joesavage1 Nov 20 '11 at 15:37
2  
    
Thanks - just finished setting it up and it worked a treat :) –  joesavage Nov 21 '11 at 19:26

Assuming you are running PHP, you can try to isolate your friend's website in either of these ways:

  1. (easier, but less secure and convenient) Set safe_mode and open_basedir for your friend. In this case, the files in his directory wouldn't have access to anything else on the web server. Though, as written on PHP website, relying on safe_mode is discouraged and this feature is deprecated in PHP 5.3.0 .

  2. (difficult for the first time, but more secure and convenient later) Make PHP execute scripts in your friend's directory under a separate user. How to achieve that depends on your current PHP and Apache configuration. If you are using mod_php, then you may look at suPHP (http://www.suphp.org/), which is an also an Apache module. If you have PHP as CGI or FastCGI, you may try to set up suEXEC (https://httpd.apache.org/docs/2.2/suexec.html).

share|improve this answer
    
I have PHP setup (The most recent version I think), but no real idea how. I use Ruby on Rails for the main part of my system and just rely on PHP for a few little bits (contact forms and such). How would I go about doing either of these options for my friends directory? –  Joesavage1 Nov 20 '11 at 15:37
    
safe_mode is deprecated in PHP 5.4, and open_basedir has had a number of bypasses throughout the years. Neither is really a reliable way to secure a server. –  devicenull Nov 21 '11 at 0:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.