The end of Suhosin; what is next?

For many years, I zealously have used Suhosin with any implementations of PHP5 on Apache2 or PHP-FPM Nginx webservers to defend against SQL injection and other common web attacks. In fact, PHP5 was so disastrous, both in terms of its core security, and its functions and modules that I could have never conceived using it without any significant hardening that Suhosin provides.

As PHP5 is depreciated and my legacy programs are all gone, I am left with several implementation of PHP7 and no available Suhosin patches.

Although, it is still technically possible to add Suhosin to PHP 7.0 and 7.1 (pre-alpha – not for production), it is fair to say that the project has long been gone and PHP7 already proved that it can be troublesome like it was its predecessor. PHP7의 WAF와 핵심 보안에 새로운 추가 기능을 생각하고 있는데, 이것들이 제가 가져온 몇 가지 해결책:

나쁜 기능 또는 불필요한 기능 비활성화

PHP 내에 내장된 위험한 함수들이 많아 위험할 수 있으므로 기본적으로 'php.ini' 내에서 비활성화해야 합니다. 아래 명령어를 사용해 설정 파일을 찾아 vi나 nano로 기능을 비활성화할 수 있습니다.

php -i | grep "php.ini"

주의하세요: 여러 버전의 PHP를 동시에 실행 중이거나 프로그램이 다른 서드파티 애플리케이션의 일부로 설치되어 있다면, 여러 개의 'php.ini'이 설치되어 있을 가능성이 높으며, 웹서버에서 어떤 것이 로드되었는지 명확하지 않습니다. 올바른 버전을 편집하고 있는지 확인하세요 (php -v).

Add the below line at the end of ‘php.ini’ file, make sure that you saved the file, and restart the webserver. You can learn about each of these PHP functions at this address. As a measured action, you may want to add them one by one to make sure that it does not negatively affect your applications.

disable_functions = popen, eval, leak, exec, shell_exec, curl_exec, curl_multi_exec, parse_ini_file, mysql_connect, system, phpinfo, escapeshellarg, escapeshellcmd, passthru, symlink, show_source, mail, sendmail, proc_open, proc_nice, proc_terminate, proc_get_status, proc_close, pfsockopen, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid

Disabling Register Globals and Base64

Register Global is a function by PHP that allows input arrays to the URL to be converted to variable inside your code. Therefore, any potentially vulnerable code can be exploited by an attacker who can pass malicious arrays using HTTP GET or POST requests.

Register Globals can be easily disabled by adding the below line at the end of ‘php.ini’. Do not forget to restart the webserver to execute the changes.

register_globals = Off

Register Globals와 마찬가지로, Base64는 악의적인 백도어로 이어질 수 있는 또 다른 불필요한 기능입니다.. 아래 라인을 'php.ini' 파일 끝에 추가하여 Base64 디코더를 영구적으로 비활성화할 수 있습니다..

base64_decode = Off