May 11, 2010
Now that we have a secure Apache HTTP server installation, we need to setup PHP. I will use PHP 5.2.13 for this tutorial, not 5.3 as I’ve found that breaks a lot of web applications.
For this, I will be compiling in the Suhosin patch and extension, and enabling various database and other modules that come in handy when working with PHP. I’ve found that I need these to be able to use various software packages.
The first step is to go to PHP.net and get the url for the download. For PHP 5.2.13 that url is http://ca.php.net/distributions/php-5.2.13.tar.bz2
# Setup a work directory
mkdir /root/phptemp; cd /root/phptemp
wget http://ca.php.net/distributions/php-5.2.13.tar.bz2
tar -jxvf php-5.2.13.tar.bz2
#Now we need to grab the latest Suhosin and hardened PHP patches
wget http://download.suhosin.org/suhosin-patch-5.2.13-0.9.7.patch.gz
wget http://download.suhosin.org/suhosin-0.9.31.tgz
tar -xvzf suhosin-0.9.31.tgz
gunzip suhosin-patch-5.2.13-0.9.7.patch.gz
#Please note that I skipped the signature testing of the two files. This is optional but recommended that you do not skip
cd php-5.2.13
patch -p 1 -i ../suhosin-patch-5.2.13-0.9.7.patch
The next step involves configuring PHP. You may need to modify some of the paths or install some required software packages
# Configure PHP with common modules
./configure --with-apxs2=/opt/httpd/bin/apxs --prefix=/opt/php --exec-prefix=/opt/php --with-config-file-path=/opt/php/etc --without-sqlite --with-mysql=/opt/mysql --with-mysqli=/opt/mysql/bin/mysql_config --with-zlib --with-bz2 --with-gd --with-curl --with-openssl --with-mcrypt --with-mhash --enable-mbstring --with-kerberos --with-imap-ssl -with-gettext --with-ttf --enable-exif --with-pear --enable-gd-native-ttf --with-freetype-dir=/usr/include/freetype2/freetype --with-jpeg-dir=/usr/bin --with-png-dir=/usr/bin --enable-calendar --enable-sockets
# Compile
make
# make test may not work if you are upgrading and have disabled certain functions
make test
# Copy the binaries to their proper directories
make install
make clean
For 64 bit systems the configure code should be like this
./configure --with-apxs2=/usr/local/apache2/bin/apxs --without-sqlite --with-mysql --with-mysqli --with-zlib --with-bz2 --with-gd --with-curl --with-openssl --with-mcrypt --with-mhash --enable-mbstring --with-kerberos --with-imap-ssl --prefix=/usr --with-config-file-path=/etc -with-gettext --with-ttf --enable-exif --with-pear --enable-gd-native-ttf --with-freetype-dir=/usr/include/freetype2/freetype --with-jpeg-dir=/usr/bin --with-png-dir=/usr/bin --enable-calendar --with-libdir=lib64
Ok, so now PHP is installed/upgraded and now we need to compile and install the Suhosin extension.
cd /root/phptemp;cd suhosin-0.9.31
phpize
./configure
make
make install
vi /etc/php.ini
Find the extensions section (Or just append to the bottom)
extension=suhosin.so
This is not a complete resource for install PHP and Suhosin. I really recommend you read about Suhosin on their website. It is best if you understand this really amazing product.
Now the Suhosin extension is installed, and enabled, but some of the other extensions may or may not of been enabled. Use the above syntax of extension=name.so to enable them, restarted Apache after each one to make sure everything works OK.
PHP can be dangerous if configured improperly, and very useful if configured properly. Here is some common options I use.
Disable some dangerous functions
disable_functions = "apache_child_terminate, apache_setenv, define_syslog_variables, escapeshellarg, escapeshellcmd, eval, exec, fp, fput, ftp_connect, ftp_exec, ftp_get,ftp_login, ftp_nb_fput,ftp_put, ftp_raw, ftp_rawlist, highlight_file, ini_alter, ini_get_all, ini_restore, inject_code, mysql_pconnect, openlog, passthru, php_uname, phpAds_remoteInfo, phpAds_XmlRpc, phpAds_xmlrpcDecode,phpAds_xmlrpcEncode, popen, posix_getpwuid, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid,posix_setuid, posix_setuid, posix_uname, shell_exec, syslog, system, xmlrpc_entity_decode,proc_close, proc_get_status, proc_nice, proc_open, proc_terminate"
I set all of my open_basedir options for each virtual host, but I also set a default option just in case. For my server, I have Apache setup using the webroot /chroot/www with a symlink /www pointing to /chroot/www. In my php.ini file, I set open_basedir = /www as a failsafe.
Load some useful extensions
extension=fileinfo.so
extension=imagick.so
extension=imap.so
extension=suhosin.so
extension=zip.so
LAMP Server Setup Pt. 1 – Installing Apache HTTP Server
LAMP Server Setup Pt. 2 – Installing Mod_Security
LAMP Server Setup Pt. 3 – Installing Mod_Chroot
LAMP Server Setup Pt. 4 – Installing PHP
LAMP Server Setup Pt. 5 – Configuring Apache
Recent Comments