[Mono-list] mod_mono in a shared hosting envionment

[Jesse Pasichnyk]

Hi David,

There have been several posts about this sort of thing in the past (from me
and others), and I think the consensus is its probably better to run
standalone xsp servers per site.  That way you can chroot the xsp (optional
of course) as well as run it as the user who owns the site.  This would
limit the problem of bad users or exploited sites doing too much damage.  I
believe people also argue against mod_mono because that would tie the GC
instance to the apache server in some sorts (I'm not aware of how that works
though, someone else may be able to provide more reasoning behind it).  If
you do choose to run separate xsp instances you could use mod_proxy to setup
forward and reverse proxies to the xsp instance.  This could be initially
just setup running xsp instances on ports of 127.0.0.1, but could be in the
future scaled out to multiple application servers.

I also modified the mod_mono itself a while back to call an external
assembly (passing some extra parameters) instead of the mod-mono-server.exe.
That assembly was setuid root and did a ton of validation before doing
anything.  It then spawned off a mod-mono-server as the appropriate user,
this would also be an option.

I personally have leaned towards the way of running XSP standalone and just
proxying however.  This leads to greater scalability... You could have an
array or application servers behind a scalable number of web boxes, the
webboxes would then just forward the requests on.  It also makes for easier
upgrades to newer versions of the software.  Coupled with mod_security this
could also lead to an extra firewall'ish layer between your web and
application servers, blocking potential security breaches before they even
get to the xsp instance.

Just some ideas, hope that helps.  Feed back from anyone would be much
appreciated.

Jesse 

-----Original Message-----
From: mono-list-bounces at lists.ximian.com
[mailto:mono-list-bounces at lists.ximian.com] On Behalf Of David Darville
Sent: Wednesday, November 23, 2005 4:58 AM
To: mono-list at lists.ximian.com
Subject: [Mono-list] mod_mono in a shared hosting envionment


I am working on integrating mod_mono in our shared hosting environment, but
I have noticed that it is possible for a script to access and modify the
files of all other users, which sounds like a security nightmare to me.

So I wonder if there is any way to limit which files mod-mono-server.exe can
access, mabye something similar to php's open_basedir configuration option.

---

David Darville
_______________________________________________
Mono-list maillist  -  Mono-list at lists.ximian.com
http://lists.ximian.com/mailman/listinfo/mono-list