Post B7UVTFXZRIKvQBpZce by h3artbl33d@exquisite.social
 (DIR) More posts by h3artbl33d@exquisite.social
 (DIR) Post #B7UVTEgOcznmlGx6jw by h3artbl33d@exquisite.social
       0 likes, 0 repeats
       
       Almost done with migrating ~ 150 websites from a couple of Serverpilot VPS'es. What an extremely crappy and shitty platform that is. Their salespitch includes "App Isolation" - but there is nearly none. One badly managed website was able to take the whole VPS down, due to it having no resource control at all. Already got several huge conpliments on how migrated websites were much more stable, performant and resilient. #SysOpLife #SysOp #Server #Management
       
 (DIR) Post #B7UVTEuZmH91TFaQqG by h3artbl33d@exquisite.social
       0 likes, 0 repeats
       
       There are various ways how proper app isolation and resource limitations can be implemented:Linux: if you are hosting multiple websites with a control panel (DirectAdmin, cPanel, etc) - use CloudLinux. Enable LVE, CageFS, DB Governor and make sure all the accounts have CageFS enabled. Can be done through cgroups too.BSD: Use jails, VMs, etc.Just getting each account their own PHP-FPM pool is insufficient. Sites are still sharing the system resources and filesystem. Exploiting a vuln somewhere in the application or stack might just lead to a full server compromise, rather than it being limited to the exploited site.
       
 (DIR) Post #B7UVTFAWoxuAGj3Ahs by h3artbl33d@exquisite.social
       0 likes, 0 repeats
       
       WordPress is extremely popular - the WP core itself is quite decent in the terms of security - for an average website that does not have a large threat model.The problem, however, is that there is very little quality control on the ecosystem. Extremely poor and badly designed plugins are extremely common and expose the (WP) website to a huge attack surface.With no proper isolation between sites, it is rather easy to exploit a vuln and bilaterally move towards the other sites hosted on the same machine/VPS/VM.
       
 (DIR) Post #B7UVTFSFl45D9hLKKm by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @h3artbl33d Wordpress is a popular remote administration tool that also happens to be able to display websites somewhat 😹
       
 (DIR) Post #B7UVTFXZRIKvQBpZce by h3artbl33d@exquisite.social
       0 likes, 0 repeats
       
       For instance, the plugin 'Really Simple SSL' is tens of thousands of lines of code that can be trivially achieved in the webserver config with 5 or 6 lines.But that specific plugin doesn't even begin to scratch the surface. Others are soooo much worse - and they are still available in the WP plugin repo. Not even a small warning.
       
 (DIR) Post #B7UVTFtu6GCWXSHPQu by h3artbl33d@exquisite.social
       0 likes, 0 repeats
       
       And the bad thing is that "shared webhosting" often includes email as well. Meaning that - even with proper isolation - a compromised website might compromise the mailboxes too.