The end of Suhosin; what is next?
For many years, I zealously have used Suhosin with any implementations of PHP5 on Apache2 or PHP-FPM Nginx webservers to defend against SQL injection and other common web attacks. In fact, PHP5 was so disastrous, both in terms of its core security, and its functions and modules that I could have never conceived using it without any significant hardening that Suhosin provides.
As PHP5 is depreciated and my legacy programs are all gone, I am left with several implementation of PHP7 and no available Suhosin patches.
Although, it is still technically possible to add Suhosin to PHP 7.0 iyo 7.1 (pre-alpha – not for production), it is fair to say that the project has long been gone and PHP7 already proved that it can be troublesome like it was its predecessor. As I am thinking about a new addition to the WAF and core security of PHP7, these are some of the solutions I came with:
Disabling Bad or Unnecessary Functions
There are many risky functions built inside the PHP that are potentially dangerous and should be disabled inside ‘php.ini’ by default. You can find the config file using the below command and disable the functions via vi or nano.
php -i | grep "php.ini"PLEASE NOTE: If you are running various versions of PHP simultaneously or the program is installed as part of another third-party application, then the chances are high that you have multiple ‘php.ini’ installed and it is not clear which one is loaded by the webserver. Make sure that you are editing the correct version (php -v).
Add the below line at the end of ‘php.ini’ file, make sure that you saved the file, and restart the webserver. You can learn about each of these PHP functions at this address. As a measured action, you may want to add them one by one to make sure that it does not negatively affect your applications.
disable_functions = popen, eval, leak, exec, shell_exec, curl_exec, curl_multi_exec, parse_ini_file, mysql_connect, system, phpinfo, escapeshellarg, escapeshellcmd, passthru, symlink, show_source, mail, sendmail, proc_open, proc_nice, proc_terminate, proc_get_status, proc_close, pfsockopen, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuidDisabling Register Globals and Base64
Register Global is a function by PHP that allows input arrays to the URL to be converted to variable inside your code. Therefore, any potentially vulnerable code can be exploited by an attacker who can pass malicious arrays using HTTP GET or POST requests.
Register Globals can be easily disabled by adding the below line at the end of ‘php.ini’. Do not forget to restart the webserver to execute the changes.
register_globals = OffJust like Register Globals, Base64 is another often unnecessary feature that open the door into malicious back-doors. You can disable Base64 decoder permanently by adding the below line to the end of ‘php.ini’.
base64_decode = OffPost Disclaimer
The views, information, or opinions expressed are solely those of the author and do not necessarily represent those of his employer or the organizations with which he is affiliated.
Macluumaadka ku jira qoraalkan waxaa loogu talagalay ujeeddooyinka guud ee macluumaadka oo kaliya. Macluumaadka waxaa bixiyey Farhad Mofidi waxaana uu dadaalaa inuu macluumaadka ka dhigo mid hadda jira oo sax ah, laakiin ma sameeyo wax matalaad ama damaanad qaad ah oo nooc kasta ah, si cad ama si leexsan, ku saabsan dhamaystirka, saxnaanta, kalsoonida, ku habboonaanta ama helitaanka bogga internet-ka. Farhad ma sameeyo wax matalaad ama damaanad qaad ah. ama wax macluumaad ah, alaabooyin ama garaafyo la xiriira oo ku jira qoraal kasta oo loogu talagalay ujeedo kasta.
Sidoo kale, AI waxaa laga yaabaa in loo isticmaalo aalad si loogu bixiyo talooyin iyo in la hagaajiyo qaar ka mid ah waxyaabaha ama jumladaha. Fikradaha, aragtiyada, moodooyinka, iyo alaabooyinka ugu dambeeya waa kuwa asalka ah oo bini'aadamka ay sameeyeen qoraaga.