5.17. Suhosin

Step of installation for Suhosin:
1. Download suhosin and install it
#cd /usr/local/
#wget http://www.hardened-php.net/suhosin/_media/suhosin-0.9.18.tgz
#tar -zxvf suhosin-0.9.18.tgz
#cd suhosin-0.9.18
#phpize
#./configure
#make && make install
2. Adding a load directive to php.ini
extension=suhosin.so
[suhosin]
suhosin.get.max_value_length = 5120
3. Restart apache service
#/etc/init.d/httpd restart

Configuration

Logging Configuration
suhosin.log.syslog
suhosin.log.syslog.facility
suhosin.log.syslog.priority
suhosin.log.sapi
suhosin.log.script
suhosin.log.phpscript
suhosin.log.script.name
suhosin.log.phpscript.name
suhosin.log.use-x-forwarded-for
Executor Options
suhosin.executor.max_depth
suhosin.executor.include.max_traversal
suhosin.executor.include.whitelist
suhosin.executor.include.blacklist
suhosin.executor.func.whitelist
suhosin.executor.func.blacklist
suhosin.executor.eval.whitelist
suhosin.executor.eval.blacklist
suhosin.executor.disable_eval
suhosin.executor.disable_emodifier
suhosin.executor.allow_symlink
Misc Options
suhosin.simulation
suhosin.apc_bug_workaround
suhosin.sql.bailout_on_error
suhosin.sql.user_prefix
suhosin.sql.user_postfix
suhosin.multiheader
suhosin.mail.protect
suhosin.memory_limit
Transparent Encryption Options
suhosin.session.encrypt
suhosin.session.cryptkey
suhosin.session.cryptua
suhosin.session.cryptdocroot
suhosin.session.cryptraddr
suhosin.session.checkraddr
suhosin.cookie.encrypt
suhosin.cookie.cryptkey
suhosin.cookie.cryptua
suhosin.cookie.cryptdocroot
suhosin.cookie.cryptraddr
suhosin.cookie.checkraddr
suhosin.cookie.cryptlist
suhosin.cookie.plainlist
Filtering Options
suhosin.filter.action
suhosin.cookie.max_array_depth
suhosin.cookie.max_array_index_length
suhosin.cookie.max_name_length
suhosin.cookie.max_totalname_length
suhosin.cookie.max_value_length
suhosin.cookie.max_vars
suhosin.cookie.disallow_nul
suhosin.get.max_array_depth
suhosin.get.max_array_index_length
suhosin.get.max_name_length
suhosin.get.max_totalname_length
suhosin.get.max_value_length
suhosin.get.max_vars
suhosin.get.disallow_nul
suhosin.post.max_array_depth
suhosin.post.max_array_index_length
suhosin.post.max_name_length
suhosin.post.max_totalname_length
suhosin.post.max_value_length
suhosin.post.max_vars
suhosin.post.disallow_nul
suhosin.request.max_array_depth
suhosin.request.max_array_index_length
suhosin.request.max_totalname_length
suhosin.request.max_value_length
suhosin.request.max_vars
suhosin.request.max_varname_length
suhosin.request.disallow_nul
suhosin.upload.max_uploads
suhosin.upload.disallow_elf
suhosin.upload.disallow_binary
suhosin.upload.remove_binary
suhosin.upload.verification_script
suhosin.session.max_id_length

suhosin有三个选项控制eval

suhosin.executor.eval.whitelist        白名单
suhosin.executor.eval.blacklist        黑名单
suhosin.executor.disable_eval        禁用eval
很多程序需要eval，所以我们不能禁用，使用黑名单禁止一些危险的函数
编辑php.ini
[Suhosin]
suhosin.executor.eval.blacklist=phpinfo,fputs,fopen,fwrite
根据实际情况自行设定

包含漏洞

suhosin.executor.include.max_traversal        包含的最大目录深度，在包含的文件名中有多少个../就禁止，例如值为2时，../../etc/passwd会禁止，值为3则允许，对于大多数程序，这个值设为4或5比较合适
suhosin.executor.include.whitelist        允许包含的URL，用逗号分隔
suhosin.executor.include.blacklist        禁止包含的URL，用逗号分隔

上传漏洞

suhosin.upload.max_uploads
suhosin.upload.disallow_elf
suhosin.upload.disallow_binary
suhosin.upload.remove_binary
suhosin.upload.verification_script        上传文件检查脚本
可以自己写一个脚本检查上传文件是否有webshell特征，然后suhosin.upload.verification_script 的值是这个脚本的绝对路径

其他更深入的防护措施，还有待研究，参考suhosin选项 http://www.hardened-php.net/suhosin/configuration.html

原文出处：Netkiller 系列 手札
本文作者：陈景峯
转载请与作者联系，同时请务必标明文章原始出处和作者信息及本声明。