So I am trying to decided if i should sell shells or not on my site! I heard it's a quick way to earn cash! On the flip side it opens your ip for packeting and attacks from hackers ....

Can anyone give me their thoughts

Well. If you can secure the server properly, it'll keep the hackers out. But, it's true that shell servers and DOS attacks, go hand in hand.

Like Jay said, shell accounts be dangerous tools if place in the wrong hands. Apart from being apart to rake havoc on your server, you could open yourself to unnecessary trouble by allowing others to rake further havoc on other sites.

If the shell access comes as part of a web hosting package to allow your clients to install some scripts or stuffs for their website, it might not be all that bad. Although such move can still open you up to abuse.

But shell access on its own is another issue altogether.

Personally, I feel uncomfortable about granting such power. It is almost like saying, Hey! we rent guns. Yes, it probably might be profitable but would you want to be responsible for their actions ?

We offer shell access on our packages, however it is not enabled as default on all accounts and must be requested, even then we screen the user before granting them the 'higher powers' of shell access. Everything you can do in Shell you can basically do via FTP using scripts etc. however Shell can make life a lot easier for those spammers and hackers and we wouldn't want to be doing that ;) so it is far better to screen people. Don't just hand it out to every man and his dog :)

Don't just hand it out to every man and his dog

[root@h10007 root]# woof
bash: woof: command not found
[root@h10007 root]#

-Matt

Originally posted by RackNine


[root@h10007 root]# woof
bash: woof: command not found
[root@h10007 root]#

-Matt
What you don't have woof? :D

root@******* [/]# whereis woof
woof: /usr/bin/woof

:dgrin:

What you don't have woof?
Sadly we only cater to 3 major languages and the blind. As far as I'm concerned dog hosting is a niche market and until widespread utilization is evident R9 won't be catering to K9's.

:D

-Matt

what do people use shells for?

PINE :D
MUD :D

To be able to surf the web using a text based interface :D

But seriously, I get pretty skeptical with shell access. Most common used would be to install irc bot, perform DOS attack, anonymize local access by telnetting through several servers before hacking sites.

pine (you mean eudora? ) mud ( you mean asherons call or everquest?)

Originally posted by combs
pine (you mean eudora? )
No, it is a email application developed by the University of Washington. If you go into shell and type "pine" you will see :)

If you want to earn fast money.... it will not be secured....as simple

MUD - Multi User Dungeon. the predecessor to network games.

lol u = 0wn3d f0r phr33:stickout

/me agrees with edwin.

MUDs are still around :) My business is based off of hosting them, so naturally, everyone needs shell access. Shell access is not an issue if you keep an eye on your servers and know what you're doing.

had shells, got hacked, turned of shells, never hacked since :)
(no, that is not a challenge!)

Selling shell accounts is more work than it's worth. With all the automation and access restriction of webhosting. why bother selling shells?

my 2 cents

If your going to sell shells keep those accounts on a different server to your good webhosting clients, they dont deserve the crap which could happen from an idiot shell user being let loose on ya box.

Why not secure the box as best you can (perhaps using a chroot jail of some type for each user), load the latest patches, run something like 'snort' (www.snort.org) as some type of IDS that can notify you of funny business, and configure Tripwire/logsentry to look for anything suspicious. (Of course, most of these measures are reactive -- so you might still get hacked of course, but at least you'll have a good audit trail).

Dan

Is it really worth the trouble ?

We used to offer Shell Access back in the day. But before anyone was allowed shell access they had to fax or scan a valid id and send it to us and we also voice verified each order via phone and only allowed shell access to people in the USA. We really didn't have much problems with it by doing it that way. But then again I knew other comapnies to do it our same way and had major problems. If you are offering IRC Shell access you are going to get DDoS'ed regardless of any security measures you take(which is way we left that area of business).

I agree with Frozen. Even for regular webhosting, I now require customers to fax a photo ID before granting shell access. There are far too many fraudsters out there, every customer is treated with scrutiny :)

Greetings:

While steps can be taken to secure shell to a degree, as it was pointed out you have to keep an eye out.

Do you have the time to watch over shell activity on a frequent basis every day?

I know there are those who will grant access if they are FAX'd or mailed documentation (photo ID, etc.); but if you've seen "Catch me if you can" in the movies, do hosting providers have the expertise to identify if such documents are valid and belong to the person requesting access?

Are you prepared if some one you granted shell access to commits a crime where some how you as the provider are called an accessory to the crime?

Is it worth the time, risk, and liability?

I cannot answer those questions for you; but for our parent company it never made sense to offer shell access.

Thank you.

i like shell

BAD BAD BAD BAD

This thread was started way back in 2002. Don't you think it's kind of old to be bumping back up? :eek: Thread closed :)