Security Configuration for PHP

One, prevent jumping out of the web directory

First modify the httpd.conf, if you only allow your PHP script to operate in the Web directory, you can also modify the httpd.conf file limit php operation path. For example, if your web directory is/usr/local/apache/htdocs, then add a few lines to the httpd.conf:

Php_admin_value Open_basedir/usr/local/apache /htdocs

This way, if the script is to read files other than/usr/local/apache/htdocs will not be allowed, if the error display opens, it will prompt such an error:

Warning:open_basedir restriction in effect. File is in wrong directory in

/usr/local/apache/htdocs/open.php on line 4

Wait a minute.

Second, prevent PHP version leaks

Can be expose_php turned off by

[[email protected] ~]# curl -I  192.168.1.30HTTP/1.1 200 OKServer: nginxDate: Wed, 15 Jul 2015 19:16:10 GMTContent-Type: text/html; charset=utf-8Connection: keep-aliveVary: Accept-EncodingX-Powered-By: PHP/5.5.23[[email protected] ~]# vim /etc/php.iniexpose_php = Off

服务器的版本信息也更改，在编译nginx之前可以将nginx修改为apapche

iii. Log of PHP and Nginx

display_errors = Off

display_startup_errors = Onlog_errors = Onerror_reporting = 0error_log = /var/log/php_errors.log

Also record Apache or nginx access logs, which are configured in the Web server

Iv. restricting file uploads

Web program is the most insecure in this place, users can upload files, than tablets, scripts, and then through other means, to do some destructive work on the site, so when uploading, to strictly check the format of the file

file_uploads = On

upload_tmp_dir =/data/www/tmpupload_max_filesize = 2Mmax_file_uploads = 20

V. Turning off access to remote resources

If this feature is enabled, file_get_contents (), include, and require are disabled for remote data such as FTP or Web content

Allow_url_fopen=off

Vi. Limitations of Post

post_max_size=2m

Seven, DOS control

Maximum execution time, maximum time to process request data, maximum available memory, preventing hash construction

max_execution_time = 30<br>max_input_time = 30<br>memory_limit = 40m<br>max_input_vars = 1000

Viii. permissions and configuration of security mode

 disable_functions =exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_sourceopen_basedir=/var/www/html/safe_mode_exec_dir = /usr/local/bin/确认以Apache或www这种非root用户运行Apache。/var/www/html目录下的owner也应是非root用户：# chown-R apache:apache /var/www/html/DocumentRoot下的文件应禁止运行或创建。设置该目录下的文件权限为0444（只读）：# chmod-R 0444 /var/www/html/设置该目录下的所有文件夹权限为0445# find /var/www/html/ -type d -print0 | xargs -0 -I {} chmod 0445 {}

 

 配置文件加上写保护# chattr +i /etc/php.ini# chattr +i /etc/php.d/*# chattr +i /etc/my.ini# chattr +i /etc/httpd/conf/httpd.conf# chattr +i /etc/

Ix. restricting outgoing connections using firewalls

Attackers will use tools such as wget to download files from your Web server. Use Iptables to block outgoing connections from Apache users. The Ipt_owner module assigns different roles to the generator of the local packet. It is only valid for output chain. The following instruction allows Vivek users to access externally via port 80

/sbin/iptables -A OUTPUT -o eth0 -m owner --uid-owner vivek -p tcp --dport 80 -m state --state NEW,ESTABLISHED  -j ACCEPT

 /sbin/iptables --new-chain apache_user/sbin/iptables --append OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT/sbin/iptables --append OUTPUT -m owner --uid-owner apache -j apache_user # allow apache user to connec to our smtp server/sbin/iptables --append apache_user -p tcp --syn -d 192.168.1.100 --dport 25 -j RETURN # Allow apache user to connec to api server for spam validation/sbin/iptables --append apache_user -p tcp --syn -d  66.135.58.62 --dport 80 -j RETURN/sbin/iptables --append apache_user -p tcp --syn -d  66.135.58.61 --dport 80 -j RETURN/sbin/iptables --append apache_user -p tcp --syn -d  72.233.69.89 --dport 80 -j RETURN/sbin/iptables --append apache_user -p tcp --syn -d  72.233.69.88 --dport 80 -j RETURN ######################### ## Add more rules here ## ######################### # No editing below # Drop everything for apache outgoing connection/sbin/iptables --append apache_user -j REJECT

 

10 .php.ini Security Configuration
(1) Open PHP Safe mode, prevent PHP trojan to execute Webshell
PHP's security model is a very important embedded security mechanism to control some functions in PHP, such as System (),
At the same time, a lot of file operation functions have permission control, also does not allow the files for some key files, such as/etc/passwd,

but the default php.ini is not open in Safe mode, we turn it on:
Safe_mode = on
 
(2) User group security
when Safe_mode is turned on, Safe_mode_gid is turned off, and the PHP script is able to access the file, and the same
users of the group are also able to access the files.
the recommended setting is:
Safe_mode_gid = Off
If we do not set up, we may not be able to operate the files in our server web directory, for example, we need to
when you are working on a file.
 
(3) Execute Program home directory in Safe Mode
If Safe mode is turned on, but you want to execute some programs, you can specify the home directory where you want to execute the program:
Safe_mode_exec_dir = D:/usr/bin
In general, do not need to execute what program, so it is recommended not to execute the System program directory, can point to a directory,
then copy the program that needs to be executed, such as:
Safe_mode_exec_dir = D:/tmp/cmd
However, I recommend that you do not execute any programs, then you can point to our web directory:
Safe_mode_exec_dir = d:/usr/www
 
(4) Include files in Safe mode
If you want to include some common files in Safe mode, then modify the options:
Safe_mode_include_dir = d:/usr/www/include/
In fact, the general PHP script contains files are in the program itself has been written, this can be set according to the specific needs.
 
(5) control the directory that PHP scripts can access
Use the OPEN_BASEDIR option to control the PHP script to access only the specified directory, which avoids the PHP script access
the files that should not be accessed to some extent limit the harm of phpshell, we can generally be set to only access the site directory:
Open_basedir = d:/usr/www
 
(6) Close danger function
If Safe mode is turned on, then the function prohibition is not necessary, but we consider it to be safe. For example,
we don't want to execute PHP functions that include the system (), or the ability to execute commands, or the ability to view PHP information
phpinfo () and so on, then we can disable them:
disable_functions = System,passthru,exec,shell_exec,popen,phpinfo
If you want to disable the operation of any files and directories, you can close many file operations
disable_functions = Chdir,chroot,dir,getcwd,opendir,readdir,scandir,fopen,unlink,delete,copy,mkdir, RmDir, Rename,file,file_get_contents,fputs,fwrite,chgrp,chmod,chown
These are just a few of the most commonly used file handling functions, and you can also combine the above command functions with this function,
will be able to resist most of the Phpshell.
 
(7) Close the PHP version information in the HTTP header leak
In order to prevent hackers from getting the PHP version of the server information, you can close the information ramp in the HTTP header:
expose_php = Off
　　
 
(8) Close registered global variables
variables submitted in PHP, including those that use post or get commits, are automatically registered as global variables and can be accessed directly,
This is very insecure for the server, so we can't register it as a global variable, and turn off the Register global variables option:
register_globals = Off
of course, if this is set, then the corresponding variable should be taken in a reasonable way, such as get the variable var of get commit,
then you need to use $_get[' var ' to get it, this PHP programmer should pay attention to.
 
(9) Open MAGIC_QUOTES_GPC to prevent SQL injection
SQL injection is a very dangerous problem, small site background was invaded, heavy the entire server fell,
so be sure to be careful. There is a setting in php.ini:
MAGIC_QUOTES_GPC = Off
This is off by default, and if it is turned on, it will automatically convert the query that the user commits to SQL.
For example, "Switch to \" And so on, which is important to prevent SQL injection. So we recommend setting it to:
MAGIC_QUOTES_GPC = on
 
(10) Error Message Control
in general, PHP is not connected to the database or in other cases there will be a prompt error, the general error message will contain PHP script when
before the path information or query SQL statements and other information, such information provided to the hacker is not secure, so the general server recommends that you suppress the error prompt:
display_errors = Off
If you are trying to display an error message, be sure to set the level of display errors, such as displaying only the information above the warning:
error_reporting = e_warning & E_error
of course, I recommend turning off the error prompt.
 
(11) Error log
It is recommended to log the error message after closing the display_errors to find out why the server is running:
log_errors = on
also set the directory where the error log is stored, suggesting that the root Apache log exists together:
error_log = D:/usr/local/apache2/logs/php_error.log
Note: The to file must allow Apache users and groups to have write permissions.

A few other security configurations

1, installation Mod_security

Modsecurity is an open source intrusion detection and prevention Web application engine. Install mod_security to protect Apache and PHP applications from XSS and other attacks

2. Install anti-DDoS module mod_evasive

can limit the frequency of access within a certain amount of time

Security Configuration for PHP