I wasn't sure on the title, so please edit it if you think it can be improved.
I run a multiplayer gaming network (the backend system that handles accounts and player lists, and I want to expand my service to include a web-based control panel. This control panel will allow users to rent game-servers which are fully compatible with my network.
The gameservers will run on a separate dedicated server. This therefore means that users will have access to the executable files their server and are able to change them.
That presents the obvious problem malicious executable files and actions. By that, I mean:
- The game the service supports has an
autoexec.cfgfile which can be populated with Windows commandline (which can be executed by the server);
- The game has server modifications which mostly require a custom DLL (yet another executable) in order to function properly;
- A certain server modification even requires the gameserver's own executable to be changed.
It should be noted that the only access that the user will have is via the web control panel and FTP (which will be their user directory such as
user1 > server1). They will not have remote desktop access.
How can I prevent damage from malicious software/server modifications that users upload? Note that this is different to a web server since the attack surface is smaller (only limited to the gameservers that run on the machine, and that there are a maximum of 20 gameservers per machine).
Here's what I can think of, but is there anything else I can do?
- A user account for each user- will allow separation of the gameserver processes for each user (easy to track a problem process down to a user);
- Limiting the amount of PIDs each user can run- each gameserver should have just one PID, so logically we can limit the amount of PIDs to the amount of gameservers the user has. Obviously this doesn't fix the 'replace with malicious copy' issue;
- Allow the user to only access the files in their folder;
- Require manual approval of all executables before they are applied;
- Virus/Malware scan on every file uploaded by the user
The operating system will be Windows Server 2008 (or 2012), each gameserver will have its own IP address, no other applications will run on the machine.