In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
I find a good step for hardening your php.ini file is to use the PHPSecInfo tool, this tool will outline what settings you have currently in your php.ini that may cause a security risk. In addition to using that tool give this article on Hardening PHP from php.ini a look its good and picks up most of the major concerns.
Personally the two main things I always make sure are configured correctly are:
- display_errors - On a production server this should be turned Off and the errors should be logged to a file.
- group_id - This is set to an appropriate value for a low privileged user e.g. www-data not root.
Another php.ini hardening could be resources limiting, as described in configuration file itself "Resource Limits". Generally, it depends on your web-application which limits should be set up. As I know, for example, for Wordpress installation 32M memory
memory_limit is not enough. Other applications requires longer time to run
max_execution_time. Also, you would like to cut down maximum time that is allowed for data to be transferred
max_input_time. Maximum POST size can also be limited
post_max_size. All of above mentioned configurations generally will help to avoid DoS conditions.
maqic_quotes_gpc, it is quite annoying, and as of PHP5.4 it was removed. Developers often automatically removes slashes by detecting this setting.