Originally Posted by pernest
I've just got my hands on a vps with centos 5.5 and have been having a lot of fun configuring it. I'll give a bullet pointed list of what I want to do, what I have and what restrictions I'm facing:
- Will be hosting multiple small low trafic sites using Apache virtual hosts
- Some sites will be Joomla!
- Want to allow ftp access for Joomla! to virtual host webroot directories
- Want to stop php from accessing system files
- selinux cannot be installed with my hosting companies virtualisation
I want to isolate and secure each virtual host as much as possible and I was trying to figure out the best way to do this. So far the security measures I've been considering are:
- Use PAM to create virtual users for vsftpd, so that ftp users are not system users and have no shell access.
- Chroot vsftpd users to their Apache virtual host webroot
- Use suPHP
- PHP safe mode
- PHP disable functions such as exec
- Create multiple system users with very restricted rights, one for each Apache virtual host
- Use php directive open_basedir
I know that these are not all compatible with one another, and some will be much more effective than others. I was hoping for some guidance as to the most sensible way to go about securing my VPS, whilst at the same time allowing the functionality I need to provide.
I know that this issue has been covered countless times on this forum and others, but I'm having trouble assimilating all this information into a best practice that I will implement.
First of all, do not set following php settings unless there is no other work around to make your sites work.
display_errors = On
allow_url_fopen = On
allow_url_include = On
max_execution_time = (set this as low as you can).
Hide the webserver name and version in apache settings.
If you are using SuExec then make sure the user (for webserver / php) under which website or php will run do not have write access to any of your files inside or outside of your sites DocumentRoot. (except session path)
Few web application really need safe_mode Off to function properly. So try to make a work around if you setting this On.
Few most voulnarable php funtions which should be disabled that could be used against the site.
phpinfo - shows information about php settings.
shell_exec - execute command via shell and return the complete output as a string
exec - It executes an external command.
system - It executes an external program and display the result.
ftp_connect- Opens an FTP connection
ftp_login- Logs in to an FTP connection
ftp_exec- Requests execution of a command on the FTP server
ftp_put- Uploads a file to the FTP server
ftp_get- Downloads a file from the FTP server
URl for more