I am thinking of offering SSH access to some customers, but am worried about the security problems that may arise if customer's have local access to the server.
If a cpanel server is kept up to date, how hard is it to root it locally? Is there a site on security that discusses this and shows what exploits are available so that I can make sure I am secure before offering SSH access?
harden your kernel, jailshell, disable compilers, keep your boxes up2date, and have a good monitor script.... your box will be fine
P4HOST.COM -- Specialize in quality Web Hosting solutions.
Affordable -- Prices are very comparative
Reliable -- Very low load average guaranteed. 60 day money back. Fast Support --Support Forum -- Providing hosting since 2003
Today there are not a lot of reasons to give shell access. Permission and such changes can be made via ftp or a simple request to your web host. I would say if you are going to offer them keep security tight. Also I would recommend getting a copy of there ID and signature incase anything does happen.
I say to all my clients, if anyone requires SSH access they can tell us what they need done, and we'll gladly do it for them.
Generally, unless trying to debug some scripts, they will not need SSH access for less than a minute. So we don't offer it - it's one less security risk to worry about, and when things go wrong, you don't have the "x" factor of what the client may have done because you're the only one with access.
You also have no control over whom the client gives the password out to.
I am just hoping someone can explain to me how it is any different than letting people run programs of their choosing. I might agree if people were auditing any CGI with excruciating care before letting it be on the server, but that stopped being industry standard many years ago and I can't really see customers going for that.
"I am just hoping someone can explain to me how it is any different than letting people run programs of their choosing. "
1. Run mod_security.org with the right settings, and that will limit what can be done in CGI, PHP, etc. in terms of security and privacy.
2. Remove direct access to compilers et all along with fetch like programs as well. That adds to security.
3. Keep a tight lid on /tmp, /var/tmp, and /usr/tmp in what can run (yes, there is a way around the nonexec, nosuid; but most common hackers don't know it -- plus you use other measures just inc ase they do).
I personally will never allow SSH access again. We had numerous attempts to break into our systems, even with latest kernels and everything up2date. In my experience, I have found it is quite easy for someone to break in within shell and sometimes even PHP. Even with safe mode on in php, I have seen ways around it.
We ended up upsetting some of our clients about 6 months ago when disabled shell all together. But, all I can say is that it is the best thing to happen to us. After disabling shell altogether, we haven't had any security problems.
Make sure to install APF or some firewall program. Allow only certain ports, and change your SSH port. And if your thinking about telnet, don't. All I can say is, I sleep much better now knowing that its more secure than before.
The only disadvantage is that you always state your SSH port if you ever have a trouble ticket with your DC.
There is always a hack or an exploit out there.