OK: a forward. I am not a security expert. I am one of four kids at a high school working on a project. I don't have any experience with real-life situations where security is a concern.
I have a project that's for automated program grading. Students upload code and we compile and test it. Obviously, there's a threat of people uploading malicious code. So what we have recently done is have the code be executed behind a runas
command on a user with little privileges. It seems to work, but then again what do we know?
Now my instructor wants us to go forward and put our project online, available to the internet. I worry that our project is likely insecure, and that us students are not qualified to assess the program's security.
Would a simple runas
-based "security" system be sufficient, or should we hold off on putting it online?
Edit: to clarify, the way it works is that people upload programs to our server, which then executes it locally and displays the results. So if the uploaded code is malicious and works, then it's our server that's taken over.