4

Surprisingly I couldn't find any related topics here, so I'll put this up. I have multiple websites running on the same server, built with various CMS's and frameworks. I need to completely isolate them. I need this because in the future I want to allow some of my clients to host websites on these server, even some potentially vulnerable code (sites full of outdated wp plugins, et cetera). Since I don't want to take responsibility for clients' code, I have to make sure that the environment is safe and if one of them gets hacked, others run fine and the server itself is not compromised.

What I have now is a very experimental environment with chroot jailed sftp access. The problem is, (and there might be other risk factors too), that all websites are ran by the same webserver user, let's say www-data. So in theory an attack involving uploading malware and executing it from the browser can harm all the websites with code owned by www-data. Similar ideas come to mind for the system database user (not the user I give to the client, but the user running the mysql process).

What's the best practice to handle this issue? Also, if you have anything, checklists, whatever, don't hesitate to share :)

  • 1
    Virtualization is the answer. – Deer Hunter Mar 31 '16 at 12:56
  • 1
    @DeerHunter, I would've just posted docker. Now you got an upvote;) – Tobi Nary Mar 31 '16 at 13:07
  • And you get an upvote too, now I see reasons behind the docker hype – Rápli András Mar 31 '16 at 20:43
3

Install a VM hypervisor on your server(s) and create a separate virtual machine for each user which runs an own webserver and database instance.

When you don't have an unique public IP address for each user, then you can point all the DNS entries to the same public IP where you run a reverse proxy which routes each request to the LAN-IP of the correct VM (side-effect: from the perspective of the users, all requests will appear to originate from the reverse proxy).

This allows the user to do whatever they want with their VM and when they totally fuck it up, you just need to reset the VM. Setting CPU and RAM quotas for the VMs also prevents your users from DOSing each others through resource consumption.

Another advantage is that you can allow the users to modify their webserver configuration without any conflicts with other users. This can be useful when users have conflicting requirements regarding certain settings or software versions.

  • Thanks. As you might guess I'm a newb on this topic so few questions. Which virtualization software do you recommend? Native doesn't come into play. I'm better off building a new server from scratch, right? Also, VMs get IPs and I just put them into the root OS's hosts file and assign it to domains, right? That's all I need to do for now. – Rápli András Mar 31 '16 at 13:22
  • @RápliAndrás I'm sorry, but these questions are off-topic on this website. Product recommendations belong to softwarerecs.stackexchange.com and server configuration questions on serverfault.com – Philipp Mar 31 '16 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.