I'm curious how VPS accounts work. I know my shared hosting provider can look through my files since they've changed things in the past. If I purchase a VPS account, like from Linode or Slicehost for example, would the folks there be able to see my clients' files I've hosted inside my VPS account? Or would they need an authorized ssh key to do so?
Linux – Can a hosting provider access files inside our VPS accounts
linuxvps
Related Solutions
If your Unix sysadmin skills are ... well, zero, then my advice is: Don't do it! Don't try to hack together a secure server configuration from a few tutorials and newbie guides.
Reasons:
- You won't succeed. The net is overflowing with turorials with poor or factually wrong content. You won't know which threats are likely for your setup and which are not, and you'll make bad judgments about which security measures to implement. The end result won't be a secure server.
- It's not an efficient use of your time. Spend your time on your key differentiators, that is your understanding of the market need and your programming skills.
You can find managed solutions very easily. Either:
Go to Webhostingtalk.com's forums, and read reviews of managed VPS providers, and pick a good one (ServInt, Wiredtree and others). The service provider handles basic OS patching etc, you're responsible for your own application.
OR
- Set up an unmanaged VPS with a good provider (Linode) and hire one of the many "outsourced sysadmin" type of companies to secure and administrate it. Again you can do comparison shopping for the "outsourced sysadmin" provider at Webhostingtalk.
It's trivially easy to do that with a UNIX MTA, eg sendmail, if you don't mind each email address being associated with an actual user on your system (make the user with useradd; put the aliases in /etc/aliases and run newaliases).
I applaud your decision to get out from under the thumb of cpanel, and I reckon you should be fine doing this if you're OK with hacking virtual hosts into your apache config, which (imho) is a lot fiddlier.
Edit: I wouldn't look for "resources for managing hosting via ssh", because a lot of UNIX guides either take it for granted that you're doing everything from the shell (ie, command line, via SSH), or provide shell alternatives to everything graphical, anyway. If I were you I'd start with the official documentation for whatever distro you're running on your VPS. If you say what that distro is, people may have other good pointers for you.
Best Answer
Ultimately there is nothing keeping them from accessing your virtual server's disk. If you are using something like Linode or Slicehost then they wouldn't do it by logging in as root unless you gave them the password. What they could do however is shut your VPS down and then mount the virtual disks on the virtual machine host. At that point all the files on your virtual server would be accessible to them. Another way of thinking about this is that if you had a physical server you leased from someone they as well could shut the server down, remove the disks and stick them in their own server to get access to what the disks contained. A VPS just makes extracting the "drives" easier.