Step 1) Get VPS for cheap
Step 2) Install mod_security with your LAMP configuration
Step 3) Add / modify your php.ini file with the follow changes:
Code:
disable_functions = show_source, system, passthru, exec, phpinfo, popen, proc_open, allow_url_fopen
; Whether to allow the treatment of URLs as files.
allow_url_fopen = Off
From working in hosting for over 7 years, mod_security will block more than 99% of web exploits, even with a default configuration. I had my own custom ruleset for CPanel servers out there for 3 years that was across 100k domains, but it was a 1.x ruleset.
With php.ini disabling the most commonly exploited commands when a phpshell is spawned you will also be safer, but the better setting is turning fopen URLs off. This means no XSS attacks like ?x=theirdomain/script.txt (XML RPC encountered a huge exploit when I was working on CPanel servers, stopped it dead from spreading same day with Mod_security.
The problem with just chmodding your files is that the hacker probably is exploiting shell to gain root privileges. There's a good chance your machine has php safe directories setup so a rogue script in one /home directory can't overwrite all of them. If I'm right and the guy keeps exploiting root, he will overwrite your files regardless. Reading this from a security linux admin standpoint, the fact it's happened twice is cause to move your site ASAP.
HostingPanama - these guys aren't cheap, but they're pretty fast, and in Panama if you couldn't guess. I'm sure other offshore providers exist that can offer an easy setup CPanel VPS.
I guess what I'm saying in total, is the only way to stay as truly secure as you can be is by keeping your programs updated, running your own dedicated or VPS (and keeping apache and PHP up to date) as well as running Mod_security and a secured PHP.
If anyone has web hosting security / dedicated server security questions of any kind, just P/M, I'd be happy to help out.
Cheers!
-K
