5 ms·

Most shared hostings work like that, they do not have a VM per user, and the professional ones don't get hacked often.

by eznzt 6y ago

tyingq 6y ago
I assume because they have more margin to keep up. If you work a system like this with $1/user minus the 30 cent Cpanel license, you have little to spend on security. The "no vm per user" means any privilege escalation bug lets a hacker wipe it all. And your unsupported customers are probably running all sorts of vulnerable stuff.
kenniskrag 6y ago
How do they secure php? The php process can access nearly anything. Also they may have remote code execution vuln: https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/php-fpm-vulnerability-cve-2019-11043-can-lead-to-remote-code-execution-in-nginx-web-servers https://www.trendmicro.com/vinfo/us/security/news/vulnerabil...
- enkrs 6y ago
  They use php-fpm pools where each website gets it's own uid:gid and the php process runs as that user. Then standard linux file permissions so you can only access your own uid files. To access web assets from nginx/apache, they add file permissions wich standard Linux acls. Altough not fancy, the security model is actually quite mature. Security problems in these servers come from misconfigured permissions and scripts, not the security stack.
  - arp242 6y ago
    Supporting shared hosting well is probably a large reason for PHP's success.
    - nkozyra 6y ago
      Sure, but there's nothing inherent to the language that fueled that. They could have done that with Python, for example. Rather, it was popular software like bulletin boards and blogging platforms that built the demand. PHP used to have one of the lowest barriers to entry because you could get by with plain HTML and incrementally add business logic inline.
      - sneak 6y ago
        Python webserver support doesn't support SSI-style open and closing code tags in HTML files to be executed per-request, last I checked. Is there anything like php or bml (bradfitz's equivalent for perl) for python, so that you can put code right in your html to be replaced at serving time with the code's output?
        shoeffner 6y ago
        https://docs.python.org/3/library/cgi.html https://docs.python.org/3/library/cgi.html All your prints are essentially sent as response with CGI, but I think for Python WSGI is the standard you should use, and you can e.g. use jinja to render HTML with templates where you can use variables, certain functions, etc. Is that what you are looking for?
        tyingq 6y ago
        PSP (python server pages) is pretty close to that. I don't think it is terribly popular. There's also Spyce.
      - 40four 6y ago
        I’ve always found that very interesting about PHP. It can do both, be a standalone scripting language, and a templating engine. Not that I would ever recommend using as a templating language in 2021 :) but it’s cool that it can do that without any external library.
        ljm 6y ago
        It's so cool that even though it's already a templating language, it's a templating language that hosts other templating languages too (Smarty, Twig).
  - archi42 6y ago
    With the recent problem in sudo, I suspect this to be a likely cause. The typical shared hosting stack uses that somewhere, so servers will have it installed. A fast, malicious user (and a slow update process) is enough to get root on one machine and penetrate the rest of the net from there (can still be avoided, but requires some effort). Just a guess, of course.
- _joel 6y ago
  Unix permissions and suexec I seem to recall, with other mitigations (chroot I think, but it's been a while since used it)
_joel 6y ago
I used to manage a fleet of cPanel servers years back, they were a pain to manage as users would regularly get infected on their local machines and have HTML infected with malicious javascript. We used a bunch of tools like clamav/configserver etc to keep on top of it but it was definitely whack-a-mole. Even with inotify style job triggers to check the newly uploaded content.
- commandlinefan 6y ago
  I set up a virtual guestbook for my daughter's birthday party last year on a cPanel-based hosting system. Couldn't for the life of me figure out why the damned thing wasn't working until I discovered that the admin had gone ahead and disabled my link "guestbook.cgi" since it was a common cPanel attack point. Apparently cPanel comes with a hackable default guest book of its own.
dabockster 6y ago
Sounds like a Docker problem. Have the isolation without the VM overhead and associated network topology.

Most shared hostings work like that, they do not have a VM per user, and the professional ones don't get hacked often.

by eznzt 6y ago

Most shared hostings work like that, they do not have a VM per user, and the professional ones don't get hacked often.

I assume because they have more margin to keep up. If you work a system like this with $1/user minus the 30 cent Cpanel license, you have little to spend on security. The "no vm per user" means any privilege escalation bug lets a hacker wipe it all. And your unsupported customers are probably running all sorts of vulnerable stuff.

kenniskrag 6y ago

How do they secure php? The php process can access nearly anything. Also they may have remote code execution vuln: https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/php-fpm-vulnerability-cve-2019-11043-can-lead-to-remote-code-execution-in-nginx-web-servers https://www.trendmicro.com/vinfo/us/security/news/vulnerabil...

enkrs 6y ago
They use php-fpm pools where each website gets it's own uid:gid and the php process runs as that user. Then standard linux file permissions so you can only access your own uid files. To access web assets from nginx/apache, they add file permissions wich standard Linux acls. Altough not fancy, the security model is actually quite mature. Security problems in these servers come from misconfigured permissions and scripts, not the security stack.
- arp242 6y ago
  Supporting shared hosting well is probably a large reason for PHP's success.
  - nkozyra 6y ago
    Sure, but there's nothing inherent to the language that fueled that. They could have done that with Python, for example. Rather, it was popular software like bulletin boards and blogging platforms that built the demand. PHP used to have one of the lowest barriers to entry because you could get by with plain HTML and incrementally add business logic inline.
    - sneak 6y ago
      Python webserver support doesn't support SSI-style open and closing code tags in HTML files to be executed per-request, last I checked. Is there anything like php or bml (bradfitz's equivalent for perl) for python, so that you can put code right in your html to be replaced at serving time with the code's output?
      - shoeffner 6y ago
        https://docs.python.org/3/library/cgi.html https://docs.python.org/3/library/cgi.html All your prints are essentially sent as response with CGI, but I think for Python WSGI is the standard you should use, and you can e.g. use jinja to render HTML with templates where you can use variables, certain functions, etc. Is that what you are looking for?
      - tyingq 6y ago
        PSP (python server pages) is pretty close to that. I don't think it is terribly popular. There's also Spyce.
    - 40four 6y ago
      I’ve always found that very interesting about PHP. It can do both, be a standalone scripting language, and a templating engine. Not that I would ever recommend using as a templating language in 2021 :) but it’s cool that it can do that without any external library.
      - ljm 6y ago
        It's so cool that even though it's already a templating language, it's a templating language that hosts other templating languages too (Smarty, Twig).
- archi42 6y ago
  With the recent problem in sudo, I suspect this to be a likely cause. The typical shared hosting stack uses that somewhere, so servers will have it installed. A fast, malicious user (and a slow update process) is enough to get root on one machine and penetrate the rest of the net from there (can still be avoided, but requires some effort). Just a guess, of course.
_joel 6y ago
Unix permissions and suexec I seem to recall, with other mitigations (chroot I think, but it's been a while since used it)

_joel 6y ago

I used to manage a fleet of cPanel servers years back, they were a pain to manage as users would regularly get infected on their local machines and have HTML infected with malicious javascript. We used a bunch of tools like clamav/configserver etc to keep on top of it but it was definitely whack-a-mole. Even with inotify style job triggers to check the newly uploaded content.

commandlinefan 6y ago
I set up a virtual guestbook for my daughter's birthday party last year on a cPanel-based hosting system. Couldn't for the life of me figure out why the damned thing wasn't working until I discovered that the admin had gone ahead and disabled my link "guestbook.cgi" since it was a common cPanel attack point. Apparently cPanel comes with a hackable default guest book of its own.

dabockster 6y ago

Sounds like a Docker problem. Have the isolation without the VM overhead and associated network topology.