Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 17 down vote favorite
10

In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?

share|improve this question

3 Answers

up vote 9 down vote accepted

I find a good step for hardening your php.ini file is to use the PHPSecInfo tool, this tool will outline what settings you have currently in your php.ini that may cause a security risk. In addition to using that tool give this article on Hardening PHP from php.ini a look its good and picks up most of the major concerns.

Personally the two main things I always make sure are configured correctly are:

  • display_errors - On a production server this should be turned Off and the errors should be logged to a file.
  • group_id - This is set to an appropriate value for a low privileged user e.g. www-data not root.
share|improve this answer
5  
allow_url_include - if you don't include PHP files from remote hosts (which seems like a silly thing to begin with), turn this setting OFF. Only harm can come from it. – MathieuK Nov 21 '10 at 8:20
There are additional requirements necessary to prevent PHP information disclosures in addition to the display_errors php.ini file directive. There are other places that one needs to check, and these should be verified if at all possible. I suggest looking into the inspathx tool. – atdre Jul 5 '11 at 3:25
2  
phpsecinfo hasn't been updated since April 2007. It looks quite stale, especially compared to the number of developments in PHP over the last 4.5 years. – Stefan Lasiewski Oct 4 '11 at 0:39
up vote 2 down vote

Another php.ini hardening could be resources limiting, as described in configuration file itself "Resource Limits". Generally, it depends on your web-application which limits should be set up. As I know, for example, for Wordpress installation 32M memory memory_limit is not enough. Other applications requires longer time to run max_execution_time. Also, you would like to cut down maximum time that is allowed for data to be transferred max_input_time. Maximum POST size can also be limited post_max_size. All of above mentioned configurations generally will help to avoid DoS conditions.

About maqic_quotes_gpc, it is quite annoying, and as of PHP5.4 it was removed. Developers often automatically removes slashes by detecting this setting.

share|improve this answer
up vote 2 down vote

You can use the following script to check your PHP security settings

http://www.idontplaydarts.com/2011/02/hardening-and-securing-php-on-linux/

share|improve this answer
3  
Hi @Phil, welcome to the site. Please always disclose your affiliations with sites you link to (See FAQ). Also please include some more description in the answer (see How to Answer), and even consider listing some of the chief things you check for. – AviD♦ Jul 5 '11 at 0:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.