I’m new to Virtualmin and I am in the process of learning and configuring. I have a question about virtual servers and the use of a reseller account with regards to hacking safety.
I previously used CPanel/WHM and created a reseller account. All my websites were created under the reseller account. However, one the Joomla sites got hacked, some php scripts were uploaded (ex: timthumb.php) but all the public_html directories of the other sites were affected as well. The .htaccess files were all replaced with a nefarious one.
Although I have been a java programmer for many years, I’m not an expert in account/file/directory permissions on Unix-based systems.
My logical structure seems to be to mirror the one I have set up with CPanel (reseller with multiple websites) but I am worried that if one site gets hacked they will all be vulnerable. Does Virtualmin manage accounts and permissions differently…or would I be subjected to the same vulnerabilites?
If you use FCGId for your websites as opposed to Apache mod_php, and if you use the recent version of Virtualmin which detects and fixes a number of security issues pertaining to symlinks and mod_php, each website (i.e. the PHP process serving its dynamic content) runs under its individual and separate user. One compromised website won’t affect other sites, as long as permissions of home directory contents are set correctly.
Virtualmin (Pro) has a reseller feature too, but using it does not mean that all websites created by customers of a reseller will get the same owner user. Every top-level website created will get its individual user, and PHP files will be executed by a separate instance/process of FCGId, running as that individual user.
