Questions tagged [shared-hosting]
A web hosting service where multiple independent websites are served by the same machine.
76 questions
0
votes
0
answers
49
views
Are these cPanel processes malicious? [duplicate]
I have previously asked a question There's an expect.php file in all the git repositories of my web server, is this malicious? and this question is a further continuation if it.
After investigating ...
- 352
1
vote
1
answer
128
views
DDoS might be very unlikely to happen to my website but in any case a CDN that should protect from it slows my website [closed]
I humbly assume that DDoS is very unlikely to happen to my website.
A CDN that should protect from it slows my website according to my personal experience and tests (perhaps only because of the ...
1
vote
1
answer
222
views
Found PHP script with erratic code, htaccess kept resetting even if I change it
When I browse on my hosting account, I found the index.php of my website has some code embedded to it, in the beginning there was really long line containing erratic code. There was also two more ...
- 35
1
vote
1
answer
201
views
Can we detect other websites of a user on a shared hosting?
I use a shared hosting plan which allows me to add multiple websites with one account/purchase. I have one website in the same plan for my work, and one for personal works. I can see both of them in ...
- 113
2
votes
1
answer
367
views
Ways to detect CVE-2017-12419 intrusion
I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time.
After fixing the gap and changing the passwords, what are some ways to detect if the ...
- 3,343
1
vote
1
answer
443
views
Remote host identification has changed - How do I know if it's an attack or not?
When connecting using SSH to a shared hosting provider I'm regularly using, I got this message today:
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
IT IS POSSIBLE THAT SOMEONE IS DOING ...
- 253
2
votes
2
answers
3k
views
What is the best file permission for .user.ini in hosting folder?
My hoster placed a .user.ini in my public_html. What is the recommended file permission be? Now it's 644.
- 35
2
votes
1
answer
2k
views
Employ fscrypt to securely protect, from data-at-rest exposure, all files+data installed after an initial Linux system build?
Our team's goal
We want to protect our sensitive data from being potentially data-at-rest exposed after we relinquish a Linux VPS (see below) provided by a hosting service. We're exploring simple(r) ...
- 141
2
votes
3
answers
617
views
Multiple wp-login.php attack on shared hosting
I am hosting more than 20 WordPress website on a single server. The server has other cms based websites too. For better security, I have used CloudLinux CageFS which encapsulates each customer. Even ...
- 322
0
votes
2
answers
232
views
Differences between compromised shared hosting and dedicated/virtual hosting
My webspace has been compromised as explained on this answered question. While looking for advice on other q&a it seems to me in the answers it is assumed the compromised system is a full ...
- 123
2
votes
1
answer
598
views
Paypal and PCI Compliance
I currently manage a few of my client's websites on a couple shared hosting providers "A2Hosting" and "Interserver".
My client wants to make a simple webstore and accept payments from said webstore. I ...
- 23
1
vote
0
answers
209
views
Breach of HTTPS shared server URLs sent through secure email
I host some simple services for my own use on a commercial shared hosting server. These URLs are cryptic and not easily guessed, and the query strings tend to be long and cryptic. The web services are ...
- 1,440
15
votes
2
answers
1k
views
Dealing with spam scripts as a shared hosting operator, with users who host mail externally
Assume the following setup;
A shared hosting server, sharing a single IP with many small websites.
A subset of the set of websites is sending e-mails. Some of those e-mails may be to their own ...
- 283
-1
votes
1
answer
169
views
Security requirements for commingling systems
Are there federal regulations/requirements that prohibit such commingling of Private systems and CUI(CUI - Controlled Unclassified Information) storage systems? I am looking at CFR-2017 title32, vol6,...
- 107
2
votes
0
answers
903
views
Digital Ocean WordPress droplet security precautions
I'm a front-end and WordPress developer. A week ago a number of my sites got hacked on shared hosting.
The sites were built to a high standard, from scratch, using Underscores. I only use a small ...
- 176
1
vote
0
answers
129
views
How to tell if my hosting data is valid or a fake copy
I'm investigating an issue where we have consistent performance issues with our company web host and bad statistcs data in our hosting console. Our hosting provider console says our IP address is one ...
user181829
45
votes
3
answers
7k
views
How do hosting providers prevent the compromise of one website from causing the compromise of another one?
Could one create a vulnerable website on purpose to attack a server of a hosting provider?
So in the question above which I recently asked we came to the conclusion that preventing one vulnerable ...
7
votes
2
answers
765
views
Could one create a vulnerable website on purpose to attack a server of a hosting provider?
Is it possible for a vulnerability in one application to be exploited to attack another application on the same server?
So according to the answer to the question above it is possible that when one ...
1
vote
2
answers
993
views
Identifying website attack type (Meuhy.php)
We have a few sites hosting on a Media Temple (MT) shared server. This morning, we noticed that some of our website were down. Upon investigation, we realized that they had been compromised. The ...
- 111
13
votes
4
answers
5k
views
Accessing multiple sites via HTTPS produces different, unrelated content (Peugeot club via HTTPS)
I've come across a random website Moodoo.cz. The interesting thing is that if you access it via the HTTPS: Moodoo.cz, the content completely changes. It is not that unusual - I guess server can serve ...
- 240
1
vote
1
answer
1k
views
Host header attacks: Possible exploits
We have an API server hosted with amazon elb. The server has only one virtual host and hence it doesn't enforce Host header. But if we manually add a Host header along with the request with a valid ...
- 1,472
3
votes
1
answer
3k
views
Will disabling "symlink" in PHP.ini prevent attackers from attacking other websites?
I have a small shared server where couple of websites are hosted, so I'm not sure if this kind of protection will be enough to prevent attackers from executing symlink attack.
I've added symlink to ...
- 1,338
1
vote
2
answers
803
views
Shared hosting is hacked [duplicate]
My shared hosting with GoDaddy was hacked by injecting a PHP file (deade6.php) that is recreated every time I delete it. I also tried to modify the .htaccess but it gets recreated as follows:
<...
- 11
6
votes
3
answers
1k
views
Any threats from isolated subdomain (controlled by hacker)?
I have a domain and a subdomain (on the same hosting) with isolated, jailed directories (no ability to go from one to another) and separate user accounts, as if they were two different domains (has ...
- 2,737
28
votes
3
answers
5k
views
Pentesting against own web service hosted on 3rd party platform
I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
- 589
3
votes
0
answers
113
views
Which level of permission and type of encryption could be used on a NAS to be secure but usable? [closed]
I need to use a NAS to stock data (from personal git and other type of service).
7777 is very permissive but it seems that the 0640 actually in use is not enough to works correctly with the services.
...
- 263
0
votes
3
answers
288
views
Shared hosting-- whose responsibility is dealing with known vulnerabilities?
I've deployed a few dozen Wordpress sites over the last 10 years across a variety of hosts. I have a single client on a particular host I've never used before whose Wordpress site has been hacked ...
- 6,338
9
votes
5
answers
11k
views
How can a PHP file be added over and over to my hacked site?
I'm on a shared hosting plan (I know, I know) on GoDaddy and all the files in it have been hacked. There are multiple sites in the plan, each of them has a folder. The folders and sub-folders of each ...
- 191
8
votes
2
answers
4k
views
Is it safe to use Memcached in a shared hosting environment?
The shared hosting I am using had Memcached enabled, I searched some forums that using Memcached in a shared hosting environment, can cause security problems like view the cache of the other user, ...
- 101
1
vote
1
answer
4k
views
How to determine whether an SSL certificate is single-domain or multi-domain
First of all I know this sounds really stupid, but I am going to explain the situation.
I created an SSL certificate for a website at StartSSL. I created a regular Class 1 SSL Certificate for a web ...
- 113
1
vote
0
answers
21
views
How to analyse a hacked server? [duplicate]
To be clear on of my server have been temporarily suspend because it was doing an DoS to another remote server.
I was informed by the hosting company of the abnormal activity and I know what was the ...
- 111
143
votes
9
answers
34k
views
Hosting company advised us to avoid PHP for security reasons. Are they right?
I'm doing a redesign for a client who's understandably concerned about security after having been hacked in the past. I had initially suggested using a simple PHP include for header and footer ...
- 1,373
0
votes
1
answer
105
views
Is there a way to guess a shared server's control panel's version?
I am performing research on the security of control panel software for shared hosting providers, and I am interested to know if there is a way to identify the version of the control panel software ...
- 193
1
vote
0
answers
67
views
Bizarre php file appeared in the image gallery folder of my website [duplicate]
Can anyone tell what this is or how it could possibly have made it to the image gallery folder of my website? It appears to be a bunch of variable definitions. Mind you that a period "." is the concat ...
- 119
0
votes
0
answers
343
views
shared hosted web server used as forward proxy
When setting up personal anonymous forward proxy server, different hosting can be chosen. In the case of shared hosting, web server, transformed into proxy server, shares it's IP with hundreds of ...
- 659
5
votes
3
answers
916
views
Recent hack appends to all javascript files
I have about 10 websites hosted on shared server by a2hosting, on apr 20 some of the js files for some of the websites were appended with a function that detects the device and if it is mobile it ...
12
votes
4
answers
2k
views
Is it possible for a vulnerability in one application to be exploited to attack another application on the same server?
If for example I have Magento-eCommerce and WordPress installed on the same server. Both have a database each with a different database username/password and both have different login details to the ...
user90185
2
votes
1
answer
146
views
Is letting users run lslogins on a shared host a security risk?
I have an account on a shared host from which I run several websites, and I noticed that lslogins is working: I get a list of the other users on the machine, their UIDs, GIDs, time of last login, ...
- 21
2
votes
1
answer
563
views
Secure MySQL data on hosted 3rd part server
I have an application that stores sensitive PII and financial data, and is hosted on a 3rd party server (typical web host). Anything sensitive is encrypted as it goes into the database, and I have no ...
- 375
18
votes
3
answers
3k
views
Will my hosting provider be able to see my SSL private keys?
I'm trying to learn the best way to implement a secure web and e-mail server. Getting SSL certificates is a must, but what happens with the private keys? I've seen that you have to store them on the ...
0
votes
1
answer
289
views
Securing communication over LAN in VPS provider [duplicate]
I'm curious about best practice when connecting from app to DB in a cloud provider. A quick rundown of our setup.
We have 4 servers all on the same provider, in the same region running as VPS. Ngnix ...
- 101
4
votes
1
answer
7k
views
How much of a security problem is PHP's proc_open() on a shared host
My company is developing a PHP system that needs to interact with Git on the server, which can currently most conveniently be done by allowing external calls via proc_open(), system() and the likes. ...
- 395
2
votes
1
answer
281
views
Folder Access restriction in Shared Hosting
In a shared hosting I use (where I don't have access to httpd.conf files) I want PHP files in "MyTargetFolder" to not have ability to access anything in upper directories.
It needs some configuration ...
- 2,737
15
votes
4
answers
2k
views
Server for School Coding Assignments
An introductory C++ course is offered every year in our university.
In order for students to code in C++ and submit their assignments, we give them shell access to a Linux server. They use ssh to log ...
- 289
2
votes
2
answers
604
views
Using free subdomains to circumvent web filtering systems
(I was told that this was the place to ask this by someone from Webmasters, if I've got it wrong again please give me a chance!)
I'm running a personal proxy service for the use of myself and some of ...
- 23
2
votes
1
answer
2k
views
Looking for advice on storing sensitive information - Rails, Postgres, https, pg_crypto, Digital Ocean
A potential contract requires the following sensitive information to be persisted in a postgres database:
Bank Account type (Uk/Int)
Bank Account Number
Bank Sort Code
Passport Number
Passport ...
8
votes
3
answers
2k
views
How private is RAM from other users on a VPS?
Can I safely assume that my RAM never can be accessed by another user on e.g. EC2 or Digital Ocean, if we suppose that I trust my provider and we don't consider possible bugs (such as Heartbleed) in ...
- 81
0
votes
0
answers
1k
views
Someone or something tried to login to my Gmail using IP address of my shared hosting
My Gmail told me someone tried to login with the correct password. But Gmail blocked it because the IP address used is different from my IP address. When I looked up the IP address that tried to login ...
1
vote
2
answers
210
views
Hosting multiple websites on the same server - Prevention from DoS
I have an server which contains around 4 instances hosted on it. I am aware that if a DoS attack happens on one of the instances it will take down all the other instances too. How to prevent such a ...
- 1,472
1
vote
1
answer
249
views
Compromised Wordpress Admin account risk
I am wondering what are the risks of a compromised Wordpress Admin account.
Can the Wordpress Admin user cause any risk to the platform running the wordpress? For example, can the admin gain access ...
- 915