Previous Thread
Next Thread
Print Thread
Rate Thread
#320651 01/14/2015 7:13 AM
Joined: Jan 2000
Posts: 5,833
Likes: 20
UBBDev / UBBWiki Owner
Time Lord
UBBDev / UBBWiki Owner
Time Lord
Joined: Jan 2000
Posts: 5,833
Likes: 20
Title: UBB suhosin Check

Author: Gizmo (James of VNC Web Services)

Requirements: UBB 7.x

Current Version: v0.1

Stock in UBB.Threads 7.5.9


About:
Some hosts with suhosin installed have the value set to the default (512) which can end up with your config.inc.php file set to blank; the below check sits on your admin landing page and displays a warning if this value is below 2048 (as recommended by Mediawiki, so I figure it's a good round number for us as well).

Basically, when we save a page in the CP it will save every value in the CP back to the config file, which can easily go over some configured suhosin values. The below check also will display what the current value is.

We have a writeup at the UBBWiki here with more information.

About suhosin:
Suhosin is an advanced protection system for PHP installations. It was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination. The first part is a small patch against the PHP core, that implements a few low-level protections against bufferoverflows or format string vulnerabilities and the second part is a powerful PHP extension that implements all the other protections.

Unlike the PHP Hardening-Patch Suhosin is binary compatible to normal PHP installation, which means it is compatible to 3rd party binary extension like ZendOptimizer.

Install Instructions:
In /admin/login.php Find:
Code
if ($ubbt_admin) {
$ubbt_admin = unserialize($ubbt_admin);
}

Add Below:
Code
// suhosin Check by VNC Web Services (http://www.virtualnightclub.net/)
if(extension_loaded("suhosin") && ini_get("suhosin.get.max_value_length")) {
if(ini_get("suhosin.get.max_value_length") <= 2048) {
$suhosin = "You may experience issues with a blank configuration file if you continue, please see <a href=\"http://www.ubbwiki.com/article/view/16/issues-with-suhosin.html\" target=\"_blank\">UBBWiki: Issues with suhosin</a>; this issue pertains to the settings of the suhosin module with your webhost. Your current suhousin length is: ". ini_get("suhosin.get.max_value_length") .".";
} else {
$suhosin = "";
}
}


In /templates/default/admin/login.tmpl Find:
Code
if ($user['USER_MEMBERSHIP_LEVEL'] == "Administrator") {
echo <<<UBBTPRINT
$open <br />[<a href="{$config['BASE_URL']}/admin/dotoggleopen.php">$dotoggle</a>]
UBBTPRINT;
}

Add Above:
Code
if($suhosin != "") {
echo <<<UBBTPRINT
<span style="color: #CC0000;">$suhosin</span><br /><br />
UBBTPRINT;
}


UBB.Dev - Putting Dev into UBB.threads
Company: VNC Web Services - UBB.threads Scripts and Scripting, Install and Upgrade Services, Site and Server Maintenance.
Forums: A Gardeners Forum, Scouters World, and UGN Security
UBB.Threads: My UBB Themes, My UBB Scripts
Sponsored Links
Gizmo #320652 01/15/2015 6:56 PM
Joined: Oct 2010
Posts: 6
Lurker
Lurker
Offline
Joined: Oct 2010
Posts: 6
Wow.. embarrassed to admit that I didn't know what this was. For any one else, here's the short description.

Quote
Suhosin (pronounced 'su-ho-shin') is an advanced protection system for PHP installations. It was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination.
So now my next challenge is to figure out how to find out if my Host vendor has it installed.

Gizmo #320653 01/16/2015 2:38 AM
Joined: Jan 2000
Posts: 5,833
Likes: 20
UBBDev / UBBWiki Owner
Time Lord
UBBDev / UBBWiki Owner
Time Lord
Joined: Jan 2000
Posts: 5,833
Likes: 20
I expanded on the about section when I got more time (coded while baby was taking a nap, written up while she was eating a snack, lol).

It's generally installed for buffer overflow protection, but is rarely adjusted from the default value of 512, this check reports an error if the value is less than 2048.


UBB.Dev - Putting Dev into UBB.threads
Company: VNC Web Services - UBB.threads Scripts and Scripting, Install and Upgrade Services, Site and Server Maintenance.
Forums: A Gardeners Forum, Scouters World, and UGN Security
UBB.Threads: My UBB Themes, My UBB Scripts
Gizmo #320654 01/16/2015 8:20 AM
Joined: Nov 2003
Posts: 329
Beta Tester
Beta Tester
Offline
Joined: Nov 2003
Posts: 329
Look in your php.ini file

you can use the control panel php info tab on your forums to over see the php info.

Scroll down to the S section and see the suhosin section.

On my set up I had to add

suhosin.post.max_value_length = 2048

into the php.ini file which i located at

/usr/local/lib

on a centos setup.

There were no other suhosin variables listed so it loads the defaults in that case.


Ive not had a problem with the default values but there are plenty of warnings around google if you search that variable so i'm giving it a go.
Attachments
suhosin.jpg (44.07 KB, 14 downloads)
Default Settings
suhosin.jpg (49.32 KB, 11 downloads)
After line added


BOOM 7.6.+ rocks....
Gizmo #320655 01/16/2015 8:51 AM
Joined: Jan 2000
Posts: 5,833
Likes: 20
UBBDev / UBBWiki Owner
Time Lord
UBBDev / UBBWiki Owner
Time Lord
Joined: Jan 2000
Posts: 5,833
Likes: 20
Well, the package that's received from their site has the default of 512, 2048 is more than capable for your config (in fact, this script shows a warning of anything below that value).

MOST users are on shared hosts, which means they generally cannot edit this value (and a lot of fly by night hosts just install things vs messing with their default values).


UBB.Dev - Putting Dev into UBB.threads
Company: VNC Web Services - UBB.threads Scripts and Scripting, Install and Upgrade Services, Site and Server Maintenance.
Forums: A Gardeners Forum, Scouters World, and UGN Security
UBB.Threads: My UBB Themes, My UBB Scripts
Sponsored Links
Gizmo #320656 01/16/2015 9:43 AM
Joined: Dec 2001
Posts: 87
Power User
Power User
Joined: Dec 2001
Posts: 87
Interesting. I'm on a VPS with Webintellects and supposedly have FULL ACCESS to my virtual server. But there is no suhosin listed in the info section.


Bill Barker
Issaquah, Wa
Bill B #320657 01/16/2015 10:10 AM
Joined: Jan 2000
Posts: 5,833
Likes: 20
UBBDev / UBBWiki Owner
Time Lord
UBBDev / UBBWiki Owner
Time Lord
Joined: Jan 2000
Posts: 5,833
Likes: 20
Originally Posted by Bill B
Interesting. I'm on a VPS with Webintellects and supposedly have FULL ACCESS to my virtual server. But there is no suhosin listed in the info section.
If the phpinfo doesn't report suhosin then it shouldn't be installed on your server; every php module loaded should indicate itself in one way or another via phpinfo.


UBB.Dev - Putting Dev into UBB.threads
Company: VNC Web Services - UBB.threads Scripts and Scripting, Install and Upgrade Services, Site and Server Maintenance.
Forums: A Gardeners Forum, Scouters World, and UGN Security
UBB.Threads: My UBB Themes, My UBB Scripts

Link Copied to Clipboard
Donate Today!
Donate via PayPal

Donate to UBBDev today to help aid in Operational, Server and Script Maintenance, and Development costs.

Please also see our parent organization VNC Web Services if you're in the need of a new UBB.threads Install or Upgrade, Site/Server Migrations, or Security and Coding Services.
Recommended Hosts
We have personally worked with and recommend the following Web Hosts:
Stable Host
bluehost
InterServer
Visit us on Facebook
Member Spotlight
JAISP
JAISP
PA
Posts: 449
Joined: February 2008
Forum Statistics
Forums63
Topics37,573
Posts293,925
Members13,849
Most Online5,166
Sep 15th, 2019
Today's Statistics
Currently Online
Topics Created
Posts Made
Users Online
Birthdays
Top Posters
AllenAyres 21,079
JoshPet 10,369
LK 7,394
Lord Dexter 6,708
Gizmo 5,833
Greg Hard 4,625
Top Posters(30 Days)
Top Likes Received
isaac 82
Gizmo 20
Brett 7
WebGuy 2
Morgan 2
Top Likes Received (30 Days)
None yet
The UBB.Developers Network (UBB.Dev/Threads.Dev) is ©2000-2024 VNC Web Services

 
Powered by UBB.threads™ PHP Forum Software 8.0.0
(Preview build 20221218)