Revolution Hosting

I’m looking at the Revolution hosting requirements. Is it fair to say that these are quite ’advanced’. I’ve looked at my current Irish (Blacknight) and UK hosts (Heart Internet) and neither of them seem to match up to the requirements. They’re both (IMHO) good hosting companies with modern soft/hardware.

Both are happily running sites with Evolution however, it means I can’t upgrade to Revo >:(

(For quick reference for others, here are the requirements: http://svn.modxcms.com/docs/display/revolution/Server+Requirements)

What requirements specifically don’t your hosts meet? I don’t see much on that page that’s particularly advanced. I can even run Revolution without problems on my Pentium 4 Ubuntu Server setup, and that’s certainly no high-end computer.

I suspect that requiring Safe_mode off will mean that most people using shared hosting aren’t going to be able to deploy Revolution.

Ahh, good point. Perhaps I am lucky then, because HostGator does not have Safe_mode on for shared hosting. Neither did Hostmonster when I was with them.

There are lots of shared hosts that know what they are doing when it comes to security. You shouldn’t really be running Evo on a server with safemode running. Servers that run suExec or have appropriate user permissions are ideal. You should at the very least be able to disable safemode via local php.ini. If you host won’t let you do that, I’d say its time to look for a new host.

You need to be very careful with any site on a shared server so their security policies are even more important as many are open to same server cross site scripting or file writes to other directories on the server. I’ve even been on a shared host that talked about security but it accidentally allowed read/write access to the server root directory.

I am not a server admin or server expert but your app is only as secure as your host makes the environment and often they (hosts) rely on outdated methods or software rather than good user and access policies.

Quote from: smashingred at Jul 18, 2010, 09:51 AM

.... You shouldn’t really be running Evo on a server with safemode running....

Why not?

On our shared hosting servers we run revolution without any issues and safe mode = off.

I would advise that you give the install a go on your existing web host, I should imagine if it worked well with evo then revolution should be no problem at all.

Aaron

@thingstodo

PHP safe mode is an attempt to solve the shared-server security problem. It is architecturally incorrect to try to solve this problem at the PHP level, but since the alternatives at the web server and OS levels aren’t very realistic, many people, especially ISP’s, use safe mode for now.

It is a poor method of server security and allows people to have insecure apps on a shared server making it actually worse off than it would be otherwise. A host who relies on SafeMode on is likely not up on security in shared environments.

I am no expert but it is a pretty big red flag that your host still uses this for "hardening" servers. If you can’t turn it off at the php.ini level I’d look for a new host entirely.

Quote from: smashingred at Jul 18, 2010, 07:47 PM

It is a poor method of server security and allows people to have insecure apps on a shared server making it actually worse off than it would be otherwise. A host who relies on SafeMode on is likely not up on security in shared environments.

I am no expert but it is a pretty big red flag that your host still uses this for "hardening" servers. If you can’t turn it off at the php.ini level I’d look for a new host entirely.

I think what you are saying is that if safe_mode is on it might indicate that the security issue it is trying to solve hasn’t been addressed properly by the hosting company at the server administration level.

I don’t think having safe_mode on *in itself* makes the environment more insecure, or have I missed something?

I suppose what I need to do is find out what that security issue is that safe_mode on is trying to address and whether my host has dealt with it properly.

At the moment I don’t really understand what the security issue is. I thought it might be to stop developers using system commands exec() etc. as that might allow third parties/hackers to execute shell code via a badly designed script, but I think there must be more to it than that.....

I’ve googled it but not found an explanation I understand yet.... any pointers?

Thanks
Mike

I think this explains it well,

http://php.net/manual/en/features.safe-mode.php

Also PHP are actually depreciating safe_mode on version 5.3.0 +