What is Suhosin Hardened PHP

Dec 9, 2008

Configuring Ubuntu, How To's, LAMP, P.C. Linux, Ubuntu, Ubuntu Server

First off Suhosin or Hardened PHP protects your server from malicious activity that can happen because of poor programming. It fixes some known vulnerabilities with secure workarounds enables some secure encryption algorithms and protects you from know application vulnerabilities (poor coding) and even unknown ones by looking for buffer overflows, etc.

Do you need it?

Well, if you are hosting only your site on your server and you wrote all of your code and you can ensure it is secure and no exploits can happen then no you don’t. Even PHP core programmers are writing insecure code from time to time, because they did not know about a PHP pitfall.

Summed up you don’t have to use it but it would be unwise not to, always keep in mind that you are not only protecting yourself and your users, but also other people on the internet, that might get attacked by your server after it has been turned into a (Spam-/DDOS-)attack drone.

What does Suhosin mean?

Suhosin (???) is a south-korean word that means something very similiar to the english guardian-angel.

Why is Suhosin called Suhosin?

According to some blog entries a few korean people are kinda suprised about the name. They wonder why a german developer has choosen a korean word for his project’s name. The reason for this is very simple. The main developer of Suhosin is interested in korea for about a year now, he enjoys watching korean movies, loves korean food and he learns the korean language for several months now. Additionally the word ‘suhosin’ is quite simple, sounds interesting, describes exactly what the program is and bypasses the problem that most english words are already taken by popular software.

Feature List

Engine Protection (only with patch)

Protects the internal memory manager against bufferoverflows with Canary and SafeUnlink Protection

Protects Destructors of Zend Hashtables

Protects Destructors of Zend Linked-Lists

Protects the PHP core and extensions against format string vulnerabilities

Protects against errors in certain libc realpath() implementations

Misc Features

Protection Simulation mode

Adds the functions sha256() and sha256_file() to the PHP core

Adds support for CRYPT_BLOWFISH to crypt() on all platforms

Transparent protection of open phpinfo() pages

EXPERIMENTAL SQL database user protection

Runtime Protection

Transparent Cookie Encryption

Protects against different kinds of (Remote-)Include Vulnerabilities
- disallows Remote URL inclusion (optional: black-/whitelisting)
- disallows inclusiong of uploaded files
- optionally stops directory traversal attacks

Allows disabling the preg_replace() /e modifier

Allows disabling eval()

Protects against infinite recursion through a configureabel maximum execution depth

Supports per Virtual Host / Directory configureable function black- and whitelists

Supports a separated function black- and whitelist for evaluated code

Protects against HTTP Response Splitting Vulnerabilities

Protects against scripts manipulating the memory_limit

Protects PHP‘s superglobals against extract() and import_request_vars()

Adds protection against newline attacks to mail()

Adds protection against \0 attack on preg_replace()

Session Protection

Transparent encryption of session data

Transparent session hijacking protection

Protection against overlong session identifiers

Protection against malicious chars in session identifiers

Filtering Features

Filters ASCIIZ characters from user input

Ignores GET, POST, COOKIE variables with the following names:
- GLOBALS, _COOKIE, _ENV, _FILES, _GET, _POST, _REQUEST
- _SERVER, _SESSION, HTTP_COOKIE_VARS, HTTP_ENV_VARS
- HTTP_GET_VARS, HTTP_POST_VARS, HTTP_POST_FILES
- HTTP_RAW_POST_DATA, HTTP_SERVER_VARS, HTTP_SESSION_VARS

Allows enforcing limits on REQUEST variables or separated by type (GET, POST, COOKIE)
- Supports a number of variables per request limit
- Supports a maximum length of variable names [with and without indicies]
- Supports a maximum length of array indicies
- Supports a maximum length of variable values
- Supports a maximum depth of arrays