Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

How do I modify suhosin settings?

Discussion in 'General Discussion' started by mikelegg, Jul 19, 2011.

  1. mikelegg

    mikelegg Well-Known Member

    Joined:
    Mar 29, 2005
    Messages:
    330
    Likes Received:
    0
    Trophy Points:
    166
    I want to change my suhosin configuration which supposedly done via the php.ini file. (Hardened-PHP Project - PHP Security - Configuration)

    I opened the PHP Configuration Editor to do this (to prevent changes from being overwritten) and clicked on the "Advanced" option, but the suhosin options aren't there.

    So I took a look at /usr/local/lib/php.ini and the settings aren't in there either.

    I know suhosin is installed and running - but I can't find it's configuration file - can anybody throw any light on this?
     
    #1 mikelegg, Jul 19, 2011
  2. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,609
    Likes Received:
    32
    Trophy Points:
    238
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    Can you check with php -v to ensure it is installed?

    Code:
    php -v
    You might try uninstalling and reinstalling it:

    Code:
    /scripts/phpextensionmgr uninstall PHPSuHosin
/scripts/phpextensionmgr install PHPSuHosin
    Those SuHosin settings should be in /usr/local/lib/php.ini file.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 cPanelTristan, Jul 19, 2011
  3. mikelegg

    mikelegg Well-Known Member

    Joined:
    Mar 29, 2005
    Messages:
    330
    Likes Received:
    0
    Trophy Points:
    166
    Thnaks Tristan

    It's definitley there -

    I'll try the uninstall / reinstall and see what happens.
     
    #3 mikelegg, Jul 19, 2011
  4. mikelegg

    mikelegg Well-Known Member

    Joined:
    Mar 29, 2005
    Messages:
    330
    Likes Received:
    0
    Trophy Points:
    166
    I did the uninstall/reinstall but the settings still don't appear in php.ini.

    Yet phpinfo() says that suhosin is installed and the messages log shows requests being blocked by suhosin (eg. suhosin[7123]: ALERT - configured GET variable limit exceeded)
     
    #4 mikelegg, Jul 19, 2011
  5. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,609
    Likes Received:
    32
    Trophy Points:
    238
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    I was incorrect myself on the behavior. Only the suhosin.so extension is loaded into php.ini file as suhosin comes with default options already set. In order to change those options, you'd need to add them to the existing /usr/local/lib/php.ini file if they aren't there. For some reason, I had thought that they were added previously, but after installing suhosin on my server again, the settings aren't appearing in the global php.ini file.

    These are the settings you can add to the existing /usr/local/lib/php.ini file:

    You can review Hardened-PHP Project - PHP Security - Configuration location for any details on the various settings.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #5 cPanelTristan, Jul 20, 2011
  6. mikelegg

    mikelegg Well-Known Member

    Joined:
    Mar 29, 2005
    Messages:
    330
    Likes Received:
    0
    Trophy Points:
    166
    Thanks Tristan
     
    #6 mikelegg, Jul 23, 2011
  7. lbeachmike

    lbeachmike Well-Known Member

    Joined:
    Dec 27, 2001
    Messages:
    306
    Likes Received:
    1
    Trophy Points:
    316
    Location:
    Long Beach, NY
    cPanel Access Level:
    Root Administrator
    Thanks Tristan - my question was the same as the above, as to where to find the configuration settings, but I'm entirely unclear on why the suhosin configuration settings are not in place at all. How is it that suhosin appears to be taking actions - at least by logging memory alerts - when it is not at all configured?

    Also, what does the lack of configuration mean that it is actually supposed to be doing by default? Does the lack of configuration settings effectively mean that it offers none of the advertised protections until they are configured?

    Thanks.

    Mike
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #7 lbeachmike, Feb 26, 2012
  8. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,338
    Likes Received:
    56
    Trophy Points:
    178
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    If you don't have specific suhosin.* directives in your php.ini, Suhosin uses the defaults set during compile time.

    The best thing for you to do is put <? phpinfo(); ?> into a php file and call it via a web browser. You'll then see all of the suhosin.* directives as well as what they are currently set to. Of course remove that file when you're done so nobody else can view it.

    Compare the suhosin.* values in your phpinfo with all of the directive options available at Hardened-PHP Project - PHP Security - Configuration, and then adjust your configuration accordingly if you feel it is necessary to do so.

    No -- the lack of specific configuration directives does NOT mean that it isn't offering any protection. It just means it's using default settings.

    M
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #8 mtindor, Feb 26, 2012
  9. lbeachmike

    lbeachmike Well-Known Member

    Joined:
    Dec 27, 2001
    Messages:
    306
    Likes Received:
    1
    Trophy Points:
    316
    Location:
    Long Beach, NY
    cPanel Access Level:
    Root Administrator
    Incidentally, if I make the change I need in php.ini, won't that get over-written with an upgrade? How can I make this change so that the change will be preserved with upgrades?

    Thanks.

    Mike
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #9 lbeachmike, Feb 26, 2012
  10. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,338
    Likes Received:
    56
    Trophy Points:
    178
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    php.ini (whether it is /usr/local/lib/php.ini or if it is a custom php.ini you have somewhere for a specific user] should not ever get overwritten. It may get "modified" -- such as when you install suhosin it will add the extension line to the php.ini. But it doesn't get overwritten.

    Of course, if you have a php.ini in place that is customized, make a backup of it just in case. But it should never get totally overwritten by a completely new/different php.ini.

    Mike
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #10 mtindor, Feb 26, 2012
(You must log in or sign up to post here.)
Loading...
Similar Threads - modify suhosin settings
  1. anhnn123

    Modify suhosin settings?

    anhnn123, Jun 16, 2018 at 2:28 AM, in forum: EasyApache
    Replies:
    1
    Views:
    49
    cPanelLauren
    Jun 18, 2018 at 12:04 PM
  2. Mat-d-rat

    [CPANEL-20670] Modify Account fails with previously used domains

    Mat-d-rat, Jun 13, 2018, in forum: General Discussion
    Replies:
    11
    Views:
    131
    cPanelMichael
    Jun 21, 2018 at 10:18 AM
  3. ecodinom

    Modify reporting mail transfer agent

    ecodinom, May 22, 2018, in forum: E-mail Discussion
    Replies:
    1
    Views:
    50
    cPanelMichael
    May 22, 2018
  4. MuNLoK

    /scripts/modify_accounts isn't working

    MuNLoK, May 16, 2018, in forum: General Discussion
    Replies:
    1
    Views:
    55
    cPanelMichael
    May 17, 2018
  5. sp3ctre69

    In Progress [CPANEL-20464] Unable to modify timeout value for Rsync backup destination

    sp3ctre69, May 12, 2018, in forum: Data Protection
    Replies:
    1
    Views:
    53
    cPanelMichael
    May 15, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice