Use Suhosin to protect PHP application systems

I have read the package this article: http://www.bkjia.com/Article/201101/81705.html

Gg has a few. With the following article

 

1. What is Suhosin?

Suhosin is a PHP program protection system. It was designed to protect servers and users against known or unknown defects in PHP programs and PHP cores. Suhosin has two independent parts, which can be used separately or jointly. The first part is a patch for the PHP core, which can defend against the weakness of buffer overflow or formatting strings; the second part is a powerful PHP extension that includes all other protection measures.

 

II,

If you are using Gentoo linux or FreeBSD, you can find Suhosin in ports. If you use OpenSuSE linux, Mandriva Linux, or Debian Linux, find Suhosin in the package released by the release.

Http://www.hardened-php.net/suhosin/download.html

Download Suhosin Extension 0.9.31 and Suhosin Patch to the PHP version.

 

Iii. feature list

1) engine protection (patch only)

1. Protects internal memory management against Buffer Overflow
2. Prevents Zend Hash Table Corruption
3. Prevent the Zend link list from being damaged
4. Protects PHP core and extensions against formatting String Vulnerabilities
5. Some libc realpath () Errors

2) Various features

1. Simulator protection mode
2. Add two functions sha256 () and sha256_file () to the PHP core.
3. Add all platforms to the CRYPT_BLOWFISH function crypt ().
4. Enable transparent protection for the phpinfo () Page
5. SQL database user protection (test phase)

3) runtime Protection

1. Encrypt cookies
2. Different types of inclusion vulnerabilities are prevented (remote URL inclusion (black/white list), uploaded files are not allowed, and directory traversal attacks are prevented)
3. Allow preg_replace ()/e modification prohibited
4. Eval () function prohibited
5. Prevents infinite recursion by configuring a maximum execution depth
6. Supports configuring blacklist and whitelist for each vhost
7. Provides a function blacklist and whitelist for code execution.
8. Prevents HTTP Response Splitting Vulnerability
9. Prevent scripts from controlling the memory_limit Option
10. Protects PHP superglobals. For the function extract () import_request_vars ()
11. Prevents new line attacks of the mail () function
12. Prevent preg_replace () Attacks

4) Session Protection

1. Encrypt session data
2. Prevent session hijacking
3. Prevents ultra-long session IDs
4. Prevents malicious session IDs

5) filter features

6) log features (omitted)

ReferenceHttp://www.hardened-php.net/suhosin/a_feature_list.html

 

4. Install Suhosin

1) download. The address is provided above.

2) decompress and patch

 

# Tar jxvf php-5.2.10.tar.bz2

# Gunzip suhosin-patch-5.2.10-0.9.7.patch.gz

# Cd php-5.2.10

# Patch-p 1-I ../suhosin-patch-5.2.10-0.9.7.patch

#./Configure -- your-options

# Make

# Make install

 

Install Extension

# Tar zxvf suhosin-0.9.31.tgz

# Cd subosin-0.9.31

# Phpize

#./Configure-with-php-config =/usr/local/php/bin/php-config (this path is set based on your actual situation)

# Make

# Make install

Then edit php. ini and add extension = suhosin. so.

Restart httpd and write a phpinfo () page, as shown below:

 

V. Configuration

Reference for all configuration options

Html ">Http://www.hardened-php.net/suhosin/configuration.html

 

6. Code Testing

Eval Execution Vulnerability

 

// Ex2.php

<? Php

$ Var = "var ";

If (isset ($ _ GET ["arg"])

{

$ Arg = $ _ GET ["arg"];

Eval ("$ var = $ arg ;");

Echo "$ var =". $ var;

}

?>

Suhosin has three options to control eval

 

Suhosin.exe cutor. eval. whitelist

Suhosin.exe cutor. eval. blacklist

Suhosin.exe cutor. disable_eval disable eval

Many programs require eval, so we cannot disable it. Use the blacklist to disable some dangerous functions.

Edit php. ini

[Suhosin]

Suhosin.exe cutor. eval. blacklist = phpinfo, fputs, fopen, fwrite

Set as needed

Before

After setting

 

Vulnerability included

 

Suhosin.exe cutor. include. max_traversal contains the maximum directory depth. How many file names are included in the directory .. /. For example, if the value is 2 ,.. /.. /etc/passwd is disabled, and 3 is allowed. For most programs, this value is set to 4 or 5.

Suhosin.exe cutor. include. whitelist allowed URLs, separated by commas

Suhosin.exe cutor. include. blacklist prohibited URLs, separated by commas

 

 

<? Php

If (isset ($ _ GET ["arg"])

{

$ Arg = $ _ GET ["arg"];

Require_once ($ arg );

}

?>

 

Before

 

Set suhosin.exe cutor. include. max_traversal = 3

 

 

Upload Vulnerability

 

Suhosin. upload. max_uploads

Suhosin. upload. disallow_elf

Suhosin. upload. disallow_binary

Suhosin. upload. remove_binary

Suhosin. upload. verification_script upload File Check script

You can write a script to check whether the uploaded file has the webshell feature. Then, the value of suhosin. upload. verification_script is the absolute path of the script.

 

Injection Vulnerability

Suhosin. SQL. bailout_on_error is not supported yet -_-#

 

For more in-depth Protection Measures, please refer to the suhosin option.

Http://www.hardened-php.net/suhosin/configuration.html