security in a shared enviroment

[kc8yds]

hi!

I have been a customer of steadfast for some time now; I now run a dedicated server which I use for various personal sites, as well as a few of my friends use it for their own sites.

I have been looking into reselling space on the server as it does not get anywhere close to as much traffic as it could support.


I am no linux expert, or anything even remotely close, but I manage to get along with any tutorials or descriptions :]


server is centos 5 with interworx

<?=file_get_contents('/home/XXXXXXX/public_html/XXXX.XXX');?>

will let you get any file on the server by any user just like that, nothing at all stopping it.

this is perfectly fine for a server where you (or yourself and other trusted people) are the only users, but what is involved if you were to start reselling service?

I have looked around on interworx's forums about security/shared hosting but did not find anything worthwhile, so I figured I would try and ask around on steadfasts forum if anyone had dealt with this in the past, and possibly had a solution


its been a long time since i had a shared hosting account @ steadfast (have gone from shared-vps-now dedicated) but I am sure that on steadfasts shared servers its not as easy as i posted above to get another users files... at least i would HOPE it is not, so there must be a way to prevent these kinds of problems.

[Justec]

Well the best thing would be if the apache module perchild i think it was called was completed, but its not and isn't under development anymore. But what it was supposed to do is run each apache thread as the user for each particular website instead of just the user 'apache' which would make things a lot more secure.

I do believe you can use open base dir option in the httpd config to help prevent what you are talking about. Here is a thread with a bit more info
http://interworx.com/forums/showthread.php?t=363
AND
http://www.interworx.com/forums/showthread.php?t=635

[NickCatal]

The simple answer is: your scripts are run as if you are running them... so you can't access another user's files without their permission.
thus the chmod

Edit: Nevermind

[Justec]

The simple answer is: your scripts are run as if you are running them... so you can't access another user's files without their permission.
thus the chmod

This is def. not true for an Iworx dedicated server