Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 16 down vote favorite

Suhosin can be used to increase the security of your php application.

I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps there.

When you are only having one webapp, your own, does it have any advantage to use Suhosin?

share|improve this question

5 Answers

up vote 7 down vote accepted

I recognize this is a very old post, but it's still one of the top ranked hits when you search on Google for PHP hardening related content. As of 2012, Arch Linux and Debian seem to have dumped Suhosin. I would say, as of 2012, it's less necessary and the following blog postings cite very good reasons for not using it (mostly related to upstream compatibility and unpredictable/unreliable release cycles): PHP 5.4.1 in - Suhosin out and Suhosin patch disabled by default in Debian php5 builds.

share|improve this answer
1  
These are more arguments for why packaging Suhosin isn't worth the effort, not why you shouldn't use it if the package is available. – Brendan Long Nov 14 '12 at 22:08
up vote 8 down vote

Personally I always run Suhosin on all my servers.

My main reasons are

  • Adds sha256() functionality to PHP.
  • Does some really good stuff in regards to filtering uploads done via PHP.
  • Disables some of the nasty PHP functions like eval(). Which is good as although you may very well not use it you can never tell what developers will get up to.
  • Also every other reason listed here is a good enough reason to run it.

Looking at the benchmark results for Suhosin the performance loss is insignificant at least to me.

share|improve this answer
up vote 7 down vote

I would recommend to use Suhosin. If you "trust" your code, you can't trust PHP, though. There are a lot of vulnerabilities found in past in interpreter itself and it is believed that they won't so simply disappear one day. Suhosin protects you from more "low-level" vulnerabilities like buffer overflows and etc.

share|improve this answer
Suhosin has many features which can be configured and individually disabled. For example, if on a dedicated server and your application already does session validation it should be safe to disable suhosin.session.encrypt. If you use it in production make sure to use it in development as well since some of it's features could cause unwanted side-effects and they can be very hard to track down. So at the very least you should read the suhosin feature list. – ColinM Mar 21 '12 at 19:54
"trusting" your code, that right there is a vulnerability. – Rook Nov 14 '12 at 20:25
up vote 2 down vote

Suhosin also adds the blowfish password hashing algorithm to platforms that do not natively support it (I think only BSD has it natively). It is far superior to MD5 and more standardized than the SHA based ones. It is also scalable, you use a configuration parameter as part of the salt to logarithmically scale the complexity of the hash, the default is 4 or 7, in a range of 0-31. A setting of 13 takes about 60 seconds per hash on a core2duo 2.4ghz.

share|improve this answer
CRYPT_BLOWFISH was added to PHP 5.3.0 (whether or not there's a system implementation). – Brendan Long Nov 14 '12 at 22:07
up vote -1 down vote

If you are using PHP only for your own server and only for your own scripts and applications, then you can judge for yourself, if you trust your code enough.

share|improve this answer
1  
What does "trust your code enough" means in this context? What kind of parts are important related to this? – Peter Smit Nov 11 '10 at 22:12
If when coding, you make sure that you can trust your code to not have any security flaws itself (SQL injection etc), then you don't really need it. – Bubby4j Nov 11 '10 at 22:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.