Shared Hosting and Security Qualms ...
| From: | Miles Thompson | Date: | Thu, 15 Aug 2002 12:36:24 +0000 |
| Subject: | Shared Hosting and Security Qualms ... | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-112741@lists.php.net to get a copy of this message | ||
This is somewhat off-topic, but has to do with shared hosting. All of my experience with Linux has been on boxes where I've pretty well had the only account. I'm now working on a shared system which provides SSH access. The idea is to host a client's site on this system, but after a few hours of exploring here's why I'm having second thoughts.
I can move up the directory tree and see all the other users directories, the contents thereof, and individual files, such as "/use/home/other_user/today.html". Permissions are such that I was not able to edit or copy them. (I tried.) The contents of etc/passwd could be listed.
mysqlshow listed all the databases on the system; with the mysql console I was able to examine the structure and contents of any of them, with a couple I went further and added a table, inserted records, and dropped the table. I could also insert records (which I subsequently deleted) into existing tables.
Call me naive, but is this normal, or should I bail on this arrangement before going any further? It's a BSD system.
Comments and opinions are solicited.
Regards - Miles Thompson