Unfortunetly setting quotes (eg for apache user)doesnt prevent from flooding
out entire disk. For example i can have running a script that will check
user directories every 15 minutes and if some directory will contain large
amount of apache generated files, user account will be disabled and files
will be removed. But what to do if for example i have 500 users and every
user directory is flooded out with bogus files? Actually i can imaging some
sort of terrorising the server this that kind of attack :)
AFAIK it's possible to set a limit on the number of inodes as well as space. So that prevents a gazillion 1byte files from killing the server.