5

I have multiple websites running on the same server, built with various CMS's and frameworks. I need to completely isolate them. I need this because in the future I want to allow some of my clients to host websites on these server, even some potentially vulnerable code (sites full of outdated wp plugins, et cetera). Since I don't want to take responsibility for clients' code, I have to make sure that the environment is safe and if one of them gets hacked, others run fine and the server itself is not compromised.

What I have now is a very experimental environment with chroot jailed sftp access. The problem is, (and there might be other risk factors too), that all websites are run by the same webserver user, let's say www-data. So in theory an attack involving uploading malware and executing it from the browser can harm all the websites with code owned by www-data. Similar ideas come to mind for the system database user (not the user I give to the client, but the user running the mysql process).

What's the best practice to handle this issue? Also, if you have anything, checklists, whatever, don't hesitate to share.

3
  • 1
    Virtualization is the answer. Mar 31, 2016 at 12:56
  • 1
    @DeerHunter, I would've just posted docker. Now you got an upvote;)
    – Tobi Nary
    Mar 31, 2016 at 13:07
  • And you get an upvote too, now I see reasons behind the docker hype Mar 31, 2016 at 20:43

1 Answer 1

4

Install a VM hypervisor on your server(s) and create a separate virtual machine for each user which runs an own webserver and database instance.

When you don't have a unique public IP address for each user, then you can point all the DNS entries to the same public IP where you run a reverse proxy which routes each request to the LAN-IP of the correct VM (side-effect: from the perspective of the users, all requests will appear to originate from the reverse proxy).

This allows the user to do whatever they want with their VM and when they totally mess it up, you just need to reset the VM. Setting CPU and RAM quotas for the VMs also prevents your users from DOSing each other through resource consumption.

Another advantage is that you can allow the users to modify their webserver configuration without any conflicts with other users. This can be useful when users have conflicting requirements regarding certain settings or software versions.

2
  • Thanks. As you might guess I'm a newb on this topic so few questions. Which virtualization software do you recommend? Native doesn't come into play. I'm better off building a new server from scratch, right? Also, VMs get IPs and I just put them into the root OS's hosts file and assign it to domains, right? That's all I need to do for now. Mar 31, 2016 at 13:22
  • @RápliAndrás I'm sorry, but these questions are off-topic on this website. Product recommendations belong to softwarerecs.stackexchange.com and server configuration questions on serverfault.com
    – Philipp
    Mar 31, 2016 at 13:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .