Running multiple sites on a LAMP with secure isolation

Question

Hi everybody, I have been administering a few LAMP servers with 2-5 sites on each of them. These are basically owned by the same user/client so there are no security issues except from attacks through vulnerable deamons or scripts. I am builing my own server and would like to start hosting multiple sites. My first concern is... ISOLATION. How can I avoid that a c99 script could deface all the virtual hosts? Also, should I prevent that c99 to be able to write/read the other sites' directories? (It is easy to "cat" a config.php from another site and then get into the mysql database) My server is a VPS with 512M burstable to 1G. Among the free hosting managers, is there any small one which works for my VPS? (which maybe is compatible with the security approach I would like to have) Currently I am not planning to host over 10 sites but I would not accept that a client/hacker could navigate into unwanted directories or, worse, run malicious scripts. FTP management would be fine. I don't want to complicate things with SSH isolation.

What is the best practice in this case? Basically, what do hosting companies do to sleep well? :)

Thanks very much! David

Answer 1

Check out ITK MPM for Apache 2.x: http://mpm-itk.sesse.net/

I am using it on a number of busy sites for a couple of years now, without any problems.

Answer 2

you should use the PHP directive open_basedir in your Apache Configuration for each Virtual Host by adding this line :

<VirtualHost x.x.x.x:80>
ServeName www.example.com
DocumentRoot /path/to/your/virtualroot
...
... usual stuff ...
...
php_admin_value open_basedir /path/to/your/virtualroot:/some/other/path
</VirtualHost>

this will limit all your PHP processes to access only this (or these) path on your filesystem. Opening files on other locations will be forbidden, even by chdir() or using symbolik links.

You can also provide this directive at runtime with ini_set() since PHP5.3.0 but imho it's better to apply this directly in your vhosts.conf file(s).

PHP Manual

Answer 3

For ultimate isolation, consider lightweight virtualization (OpenVZ on Linux, FreeBSD jails or similar). It's similar to orginary virtual machines, but shares the kernel and therefore doesn't bear the overhead of complete virtualization. The lightweight VMs can also share the disk space in a cooperative manner instead of using a separate disk image each, and can all use single copies of the same files. The drawback is that lightweight VMs always run the same kernel, i.e. you can't run one OS within another, which doesn't seem to be an issue for you.