Our sample php security config file: /etc/php.d/security.ini (you need to create this file using a text editor)
Operating systems: Ubuntu (the instructions should work with any other Linux distributions such as RHEL / CentOS / Fedora or other Unix like operating systems such as OpenBSD/FreeBSD/HP-UX).
1. 减少PHP内置模块
为了增强性能和安全性,强烈建议,减少PHP中的模块。来看看下面这个被执行命令安装的模块。
# php –m
你将会得到类似的结果:
引用
[PHP Modules]
apc
bcmath
bz2
calendar
Core
ctype
curl
date
dom
ereg
exif
fileinfo
filter
ftp
gd
gettext
gmp
hash
iconv
imap
json
libxml
mbstring
memcache
mysql
mysqli
openssl
pcntl
pcre
PDO
pdo_mysql
pdo_sqlite
Phar
readline
Reflection
session
shmop
SimpleXML
sockets
SPL
sqlite3
standard
suhosin
tokenizer
wddx
xml
xmlreader
xmlrpc
xmlwriter
xsl
zip
zlib
[Zend Modules]
Suhosin
很多程序员使用这些功能,从远程通过FTP或是HTTP协议而获得数据。然而,此法在基于PHP应用程序中会造成一个很大的漏洞。由于大部分程序员在传递用户提供的数据时没有做到适当的过滤功能,打开安全漏洞并且创建了代码时注入了漏洞。要解决此问题,需要禁用_url_fopen in /etc/php.d/security.ini,并设置以下命令:
; Limits the PHP process from accessing files outside
; of specifically designated directories such as /var/www/html/
open_basedir="/var/www/html/"
; ------------------------------------
; Multiple dirs example
; open_basedir="/home/httpd/vhost/cyberciti.biz/html/:/home/httpd/vhost/nixcraft.com/html/:/home/httpd/vhost/theos.in/html/"
; ------------------------------------