PHP {in}security
•Download as ODP, PDF•
2 likes•3,170 views
Short presentation on techniques for protecting against vulnerabilities in commonly available PHP packages using a combination of Apache + FastCGI + suEXEC + chroot + mod_security2
![Presentation Overview ,[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommended
More Related Content
What's hot
What's hot (18)
Viewers also liked
Viewers also liked (18)
Similar to PHP {in}security
Similar to PHP {in}security (20)
Recently uploaded
Recently uploaded (20)
PHP {in}security
- 1. PHP {in}security Michael Clark <michael at metaparadigm dot com>
- 3. php.ini
- 4. FastCGI
- 5. suEXEC
- 6. chroot jail
- 9. Conclusion
- 11. How do we protect against these vulnerabilities
- 12. Need to provide an environment with minimal trust for PHP applications
- 13. Only allow a minimal set of essential permissions in a hardened environment
- 14. Need to use privilege separation and chroot jails
- 18. By-product of FastCGI is that worker MPM can now be used.
- 19. Ability for Apache to handle more connections.
- 28. Dont include from any writable dirs
- 31. Detects special characters in URLs and inspects POST content type and payload.
- 32. Detects common injection patterns and exploits.
- 33. Adds additional logging (Full Request Headers).
- 36. We can't always audit and fix all of them
- 37. We can run them in a minimally trusted sandbox