Hello,
I'm wondering what the risks are to hosting a web server (web site) on your own PC. Would it be better to use a VM instead?
Risks Of Using Computer As Webhost?
I can't answer your question directly, but if you end up going with a webhost, I really like A Small Orange as a webhost.
Very cheap, almost always up, amazing customer service.
Currently, they are having a sale where you can get 45% off of new plans (on top of the regular 17% off for buying annually), which means you can get a full year of their regular plan for $27~, and you can host multiple sites on the same plan.
They had a similar sale around Black Friday a month or so ago, so I pre-bought three years of service. I've been using them for two years already, so I was satisfied enough with what they had provided that it made sense to me to stock up.
</infomercial>
More than two people try to visit your website at once and your residential DSL connection struggles to maintain the required upload bandwidth.
I'm wondering what the risks are to hosting a web server (web site) on your own PC.
There are two axes of risk: risk to the website availability, and risk to your PC itself.
Availability of a website hosted on a home PC sucks, pure and simple. Your internet connection may go out at any time, you may exceed your ISPs upstream bandwidth limits, your power may go out, someone may trip over the power cable, you may reboot your PC to install updates... Any of these cause customers to be unable to reach your website.
As for risk to your PC, it's pretty minimal. You are punching a hole in your NAT and your firewall, but HTTP is a pretty well understood protocol, and securing off-the-shelf web server software is a well understood problem.
Would it be better to use a VM instead?
You mean a VM running on the same box? See all of the above downsides, none of which a VM mitigates.
While we're making suggestions of configure-it-yourself server hosting (as opposed to HTTP-only hosting services), OVH (based in France and in Canada, near Montréal, just inches north of the US border) offer services such as this. A large variety of O/S available. They give you a 100 Mbit internet connection and no transfer limits. Does not come with DNS hosting (for that, I suggest No-Ip), but is pretty hard to beat. Especially if you're in the States, considering the CAD$ current exchange rate.
Bear in mind their VPS SSD line does not guarantee uptime or SLA, as they reserve the right to "pause" the VM without notice, in order to move it between physical hosts whenever they need to reorganize their datacenter. You have to go up to their VPS Cloud line of products to get a four-nines SLA (<= 52 hours of downtime per year).
Realistically? If you run a web server that's exposed to the internet, that machine is substantially at risk of being owned. Zero-day exploits for web hosting software pop up now and then, albeit not as often as they did a few years ago.
Don't trust the "understood" models of securing a web hosting package. If you have anything on your PC that you wouldn't want a random stranger traipsing through, then don't open that PC to the internet, and ideally don't put it on a network next to a PC that's opened up.
In other words, the only really good way to hide your sensitive data (cookies, password files, credit card info, kinky porn, whatever) is to make sure that nothing can talk to that machine without first being authorized by you. Fortunately, most NAT routers have firewalls that do a great job of this, until you go and poke holes in them. Put your web host in a separate network or a DMZ at a bare minimum - assuming the (all good) arguments above about bandwidth and availability haven't yet dissuaded you.
Don't trust the "understood" models of securing a web hosting package. If you have anything on your PC that you wouldn't want a random stranger traipsing through, then don't open that PC to the internet, and ideally don't put it on a network next to a PC that's opened up.
In other words, the only really good way to hide your sensitive data (cookies, password files, credit card info, kinky porn, whatever) is to make sure that nothing can talk to that machine without first being authorized by you. Fortunately, most NAT routers have firewalls that do a great job of this, until you go and poke holes in them. Put your web host in a separate network or a DMZ at a bare minimum - assuming the (all good) arguments above about bandwidth and availability haven't yet dissuaded you.
Also keep in mind that most ISPs (at least in the US, but I imagine elsewhere) frown at running servers on standard service contracts, and so you may be subject to having your account canceled if they detect it.
But check with your ISP and contract to be sure.
But check with your ISP and contract to be sure.
I do not recommend it. Web hosts are now extremely inexpensive (relative to the income of a typical person from the US or Western Europe). Considering the amount of your time you plan to invest in your application, spending $27 US per year for a web host is a drop in the bucket.
The main risks:
- Security: You will never be secure. Nor your webest nor your computer (And all its data).
- Hardware: Your PC and network are nothing against a real hosting server capabilities. Low performance is the greatest risk here. (Which is very important for a website).
A vm won't help you if you are using the vm on your pc....
You need a real hosting server to do the hosting. These things are meant for hosting. (though couple of vms on a single server is already a known technology- but this is a whole another debate).
Author
I'm wondering what the risks are to hosting a web server (web site) on your own PC.There are two axes of risk: risk to the website availability, and risk to your PC itself.
Availability of a website hosted on a home PC sucks, pure and simple. Your internet connection may go out at any time, you may exceed your ISPs upstream bandwidth limits, your power may go out, someone may trip over the power cable, you may reboot your PC to install updates... Any of these cause customers to be unable to reach your website.
As for risk to your PC, it's pretty minimal. You are punching a hole in your NAT and your firewall, but HTTP is a pretty well understood protocol, and securing off-the-shelf web server software is a well understood problem.
Would it be better to use a VM instead?You mean a VM running on the same box? See all of the above downsides, none of which a VM mitigates.
I have fiber internet, and around 800 Mbps upload. I won't be attempting to host a website on my own PC, though. Thanks for the advice.
This topic is closed to new replies.
Advertisement
Popular Topics
Advertisement
