[y2ksw]

Another important issue against hacking is the basic server configuration. One of the encountered problems are the Apache mpm_worker module together with fast-cgi, which eventually run a bit faster, but will not allow to sandbox virtual hosts.

In order to allow sandboxing virtual hosts, and thus avoid that other infected sites on a single server will spread over other domains, you should use mpm_prefork and then, in each virtual host configuration:

<Directory /vhosts/domain.tld/httpdocs>
php_admin_value open_basedir /vhosts/domain.tld
php_admin_value upload_tmp_dir /vhosts/domain.tld/tmp
# ... other settings
</Directory>

Eventually you could use the systems (default) tmp folder, by adding its path to the sandbox:

<Directory /vhosts/domain.tld/httpdocs>
php_admin_value open_basedir /vhosts/domain.tld:/tmp
# ... other settings
</Directory>

This is particularily important when you already have had a defacement and can't determine which domain got hacked.