24

Suhosin can be used to increase the security of your PHP application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps there.

When you are only having one web app, your own, is there any advantage in using Suhosin?

Improve this question

4 Answers 4

Reset to default
11

As of 2012, Arch Linux and Debian seem to have dumped Suhosin. I would say, it's less necessary and the following blog posts cite very good reasons for not using it (mostly related to upstream compatibility and unpredictable/unreliable release cycles):

Improve this answer
1
  • 2
    These are more arguments for why packaging Suhosin isn't worth the effort, not why you shouldn't use it if the package is available.
    – Brendan Long
    Nov 14, 2012 at 22:08
10

Personally I always run Suhosin on all my servers.

My main reasons are

  • Adds sha256() functionality to PHP.
  • Does some really good stuff in regards to filtering uploads done via PHP.
  • Disables some of the nasty PHP functions like eval(). Which is good as although you may very well not use it you can never tell what developers will get up to.
  • Also every other reason listed here is a good enough reason to run it.

Looking at the benchmark results for Suhosin the performance loss is insignificant at least to me.

Improve this answer
8

I would recommend to use Suhosin. If you "trust" your code, you can't trust PHP, though. There are a lot of vulnerabilities found in past in interpreter itself and it is believed that they won't so simply disappear one day. Suhosin protects you from more "low-level" vulnerabilities like buffer overflows and etc.

Improve this answer
2
  • Suhosin has many features which can be configured and individually disabled. For example, if on a dedicated server and your application already does session validation it should be safe to disable suhosin.session.encrypt. If you use it in production make sure to use it in development as well since some of it's features could cause unwanted side-effects and they can be very hard to track down. So at the very least you should read the suhosin feature list.
    – ColinM
    Mar 21, 2012 at 19:54
  • 1
    "trusting" your code, that right there is a vulnerability.
    – rook
    Nov 14, 2012 at 20:25
2

Suhosin also adds the blowfish password hashing algorithm to platforms that do not natively support it (I think only BSD has it natively). It is far superior to MD5 and more standardized than the SHA based ones. It is also scalable, you use a configuration parameter as part of the salt to logarithmically scale the complexity of the hash, the default is 4 or 7, in a range of 0-31. A setting of 13 takes about 60 seconds per hash on a core2duo 2.4ghz.

Improve this answer
1
  • CRYPT_BLOWFISH was added to PHP 5.3.0 (whether or not there's a system implementation).
    – Brendan Long
    Nov 14, 2012 at 22:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .