How To Harden PHP5 With Suhosin On CentOS 5.0 - Page 2

Want to support HowtoForge? Become a subscriber!
 
Submitted by falko (Contact Author) (Forums) on Thu, 2007-08-02 16:22. ::

4 Installing Suhosin

Suhosin can be downloaded from here: http://www.hardened-php.net/suhosin/download.html

To install the Suhosin patch, we need to recompile PHP5 from the sources, but we will use the CentOS 5.0 PHP5 .src.rpm package for this (using the rpmbuild command), so that we get new PHP5 .rpm packages (with Suhosin) that we can install. That way, we don't have to worry about the right PHP5 configuration options because rpmbuild will take care of this.

But first we grab a copy of the Hardened-PHP Project's release signaturekey and import it into our GNU Privacy Guard keychain:

wget http://www.hardened-php.net/hardened-php-signature-key.asc
gpg --import < hardened-php-signature-key.asc

Then we download a PHP5 .src.rpm package (that suits our currently installed PHP version, 5.1.6 in this example) from a CentOS 5.0 mirror to /usr/src and install it:

cd /usr/src
wget http://ftp-stud.fht-esslingen.de/pub/Mirrors/centos/5.0/updates/SRPMS/php-5.1.6-12.el5.src.rpm

(As you see above, I download the newest PHP5 .src.rpm from the updates/ directory of my CentOS mirror; of course, you can also download the original .src.rpm from the os/ directory, e.g. http://ftp-stud.fht-esslingen.de/pub/Mirrors/centos/5.0/os/SRPMS/php-5.1.6-5.el5.src.rpm. If you do so, you'll have to adjust the filenames in the rest of this tutorial.)

rpm -ivh php-5.1.6-12.el5.src.rpm

If you get warnings like this one:

warning: user mockbuild does not exist - using root

you can ignore it.

Next we download the Suhosin patch that suits our PHP version to /usr/src/redhat/SOURCES (you can find all available patches on the Suhosin downloads page):

cd /usr/src/redhat/SOURCES
wget http://www.hardened-php.net/suhosin/_media/suhosin-patch-5.1.6-0.9.6.patch.gz

We should check now that the MD5 sum of the downloaded patch is identical to the one published on the Suhosin downloads page:

md5sum suhosin-patch-5.1.6-0.9.6.patch.gz

If the MD5 sum is ok, we can check the digital signature like this:

wget http://www.hardened-php.net/suhosin/_media/suhosin-patch-5.1.6-0.9.6.patch.gz.sig
gpg suhosin-patch-5.1.6-0.9.6.patch.gz.sig

If you see this line in the output:

gpg: Good signature from "Hardened-PHP Signature Key"

everything is ok with the downloaded patch, and we can proceed.

Now we unpack the Suhosin patch, rename it so that it fits into the CentOS naming scheme, and modify the file /usr/src/redhat/SPECS/php.spec so that the rpmbuild command knows it has to include the Suhosin patch when it rebuilds PHP5:

gunzip suhosin-patch-5.1.6-0.9.6.patch.gz
mv suhosin-patch-5.1.6-0.9.6.patch php-5.1.6-suhosin.patch
cd /usr/src/redhat/SPECS/
vi php.spec

Add Patch0: php-5.1.6-suhosin.patch to the stanza where all patches are listed and comment out the line Patch14: php-5.1.6-ecalloc.patch in the same stanza (the ecalloc patch conflicts with Suhosin), and then add %patch0 -p1 -b .suhosin to the %setup -q stanza and comment out the line %patch14 -p1 -b .ecalloc in the same stanza:

[...]
Source51: php.ini

Patch0: php-5.1.6-suhosin.patch
Patch1: php-5.1.4-gnusrc.patch
Patch2: php-5.1.4-warnings.patch
Patch5: php-4.3.3-install.patch
Patch6: php-5.0.4-norpath.patch
Patch7: php-4.3.2-libtool15.patch
Patch13: php-5.0.2-phpize64.patch
# Patch14: php-5.1.6-ecalloc.patch
[...]
%setup -q
%patch0 -p1 -b .suhosin
%patch1 -p1 -b .gnusrc
%patch2 -p1 -b .warnings
%patch5 -p1 -b .install
%patch6 -p1 -b .norpath
%patch7 -p1 -b .libtool15
%patch13 -p1 -b .phpize64
# %patch14 -p1 -b .ecalloc
[...]

Now we rebuild PHP5:

rpmbuild -ba php.spec

Depending on what PHP5 modules you have installed, rpmbuild will most likely complain about missing packages that it needs to build new packages for the various PHP5 modules:

[root@server1 SPECS]# rpmbuild -ba php.spec
cat: /usr/include/httpd/.mmn: No such file or directory
error: Failed build dependencies:
        aspell-devel >= 0.50.0 is needed by php-5.1.6-12.i386
        httpd-devel >= 2.0.46-1 is needed by php-5.1.6-12.i386
        libjpeg-devel is needed by php-5.1.6-12.i386
        libpng-devel is needed by php-5.1.6-12.i386
        pcre-devel >= 4.5 is needed by php-5.1.6-12.i386
        libc-client-devel is needed by php-5.1.6-12.i386
        mysql-devel >= 4.1.0 is needed by php-5.1.6-12.i386
        postgresql-devel is needed by php-5.1.6-12.i386
        unixODBC-devel is needed by php-5.1.6-12.i386
        net-snmp-devel is needed by php-5.1.6-12.i386
        gd-devel is needed by php-5.1.6-12.i386
        freetype-devel is needed by php-5.1.6-12.i386
[root@server1 SPECS]#

If you see an error like this, install the missing packages, e.g. like this:

yum install aspell-devel httpd-devel libjpeg-devel libpng-devel pcre-devel libc-client-devel mysql-devel postgresql-devel unixODBC-devel net-snmp-devel gd-devel freetype-devel

Afterwards, run rpmbuild again:

rpmbuild -ba php.spec

This should now compile PHP5 and all installed PHP5 modules again and create new .rpm packages in the /usr/src/redhat/RPMS/i386 directory. This can take some time, so please be patient.

Afterwards, we can install the new PHP5 packages like this:

cd /usr/src/redhat/RPMS/i386
rpm -Uvh --force php-*

That's it for the Suhosin patch.

Now we are going to build the Suhosin PHP extension. First we download its sources to the /usr/src directory (the sources of the Suhosin extension are available on the Suhosin downloads page):

cd /usr/src
wget http://www.hardened-php.net/suhosin/_media/suhosin-0.9.20.tgz

Next we check the MD5 sum and the signature again:

md5sum suhosin-0.9.20.tgz

wget http://www.hardened-php.net/suhosin/_media/suhosin-0.9.20.tgz.sig
gpg suhosin-0.9.20.tgz.sig

Then we unpack the sources and build the extension like this:

tar xvfz suhosin-0.9.20.tgz
cd suhosin-0.9.20
phpize
./configure
make
make install

To enable the Suhosin extension, we create the file /etc/php.d/suhosin.ini and put the line extension=suhosin.so into it:

vi /etc/php.d/suhosin.ini

extension=suhosin.so

All that is left to do now is restart Apache2:

/etc/init.d/httpd restart

Now let's call our info.php page again in a browser (e.g. http://192.168.0.100/info.php). If everything went ok, you should now see Suhosin mentioned in two places on the page:

That's it. If you like you can configure Suhosin (see http://www.hardened-php.net/suhosin/configuration.html), although Suhosin will work out of the box with its default configuration, so be sure that you know what you're doing.

 

5 Links


Please do not use the comment function to ask for help! If you need help, please use our forum.
Comments will be published after administrator approval.
Submitted by unreal4u (not registered) on Thu, 2009-04-09 05:46.
If you have installed PHP 5.2.6 from the test repo
/etc/yum.repos.d/centos-test.repo: 
[c5-testing] 
name=CentOS-5 Testing 
baseurl=http://dev.centos.org/centos/5/testing/$basearch/ 
enabled=1 
gpgcheck=1 
gpgkey=http://dev.centos.org/centos/RPM-GPG-KEY-CentOS-testing 
instead of the default 5.1.6, some aditional changes have to be made in order to compile properly.

In php.spec:
Original:
Patch0: php-5.2.6-suhosin.patch 
Patch1: php-5.2.4-gnusrc.patch
 ..... 
%patch0 -p1 -b .suhosin 
%patch1 -p1 -b .gnusrc 
Replace with:
Patch0: php-5.2.6-suhosin.patch 
#Patch1: php-5.2.4-gnusrc.patch
 ..... 
%patch0 -p1 -b .suhosin 
#%patch1 -p1 -b .gnusrc 
I had to comment out the php-5.2.4-gnusrc.patch because of a tip found here.

After that, libiconv wasn't found; so i changed in "php.spec" line 398:
--with-iconv \

to:

--with-iconv=/usr/local/lib/libiconv.so \

And than it compiled correctly:
Free Image Hosting at www.ImageShack.us

QuickPost

@falko: Thanks for your GREAT guides! It really helps a lot :D
Submitted by Justin (not registered) on Fri, 2009-02-20 15:17.

Hello,

   I *was* getting the following error:

 

[root@localhost SPECS]# rpmbuild -ba php.spec
Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.22702
+ umask 022
+ cd /usr/src/redhat/BUILD
+ cd /usr/src/redhat/BUILD
+ rm -rf php-5.1.6
+ /bin/gzip -dc /usr/src/redhat/SOURCES/php-5.1.6.tar.gz
+ tar -xf -
+ STATUS=0
+ '[' 0 -ne 0 ']'
+ cd php-5.1.6
++ /usr/bin/id -u
+ '[' 0 = 0 ']'
+ /bin/chown -Rhf root .
++ /usr/bin/id -u
+ '[' 0 = 0 ']'
+ /bin/chgrp -Rhf root .
+ /bin/chmod -Rf a+rX,u+w,g-w,o-w .
+ echo 'Patch #0 (php-5.1.6-suhosin.patch):'
Patch #0 (php-5.1.6-suhosin.patch):
+ patch -p0 -b --suffix .suhosin -s
The text leading up to this was:
--------------------------
|diff -Nura php-5.1.6/configure suhosin-patch-5.1.6-0.9.6/configure
|--- php-5.1.6/configure        2006-08-23 14:55:02.000000000 +0200
|+++ suhosin-patch-5.1.6-0.9.6/configure        2006-10-27 12:24:35.000000000 +0200
--------------------------
File to patch:

 

and finally figured out why!  I had accidentally copied the following into my php.spec file:

 %patch0 -p0 -b .suhosin

 Instead of the correct (with -p1, rather than -p0)

%patch0 -p1 -b .suhosin

 Hopefully this comment will help others who went astray.  Thanks!

 

Submitted by Justin (not registered) on Fri, 2009-02-20 15:12.

Hello,

   I've repeated the steps above several times on a CentOS 5.2 VM and I keep getting the following error:

 

[root@localhost SPECS]# rpmbuild -ba php.spec
Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.22702
+ umask 022
+ cd /usr/src/redhat/BUILD
+ cd /usr/src/redhat/BUILD
+ rm -rf php-5.1.6
+ /bin/gzip -dc /usr/src/redhat/SOURCES/php-5.1.6.tar.gz
+ tar -xf -
+ STATUS=0
+ '[' 0 -ne 0 ']'
+ cd php-5.1.6
++ /usr/bin/id -u
+ '[' 0 = 0 ']'
+ /bin/chown -Rhf root .
++ /usr/bin/id -u
+ '[' 0 = 0 ']'
+ /bin/chgrp -Rhf root .
+ /bin/chmod -Rf a+rX,u+w,g-w,o-w .
+ echo 'Patch #0 (php-5.1.6-suhosin.patch):'
Patch #0 (php-5.1.6-suhosin.patch):
+ patch -p0 -b --suffix .suhosin -s
The text leading up to this was:
--------------------------
|diff -Nura php-5.1.6/configure suhosin-patch-5.1.6-0.9.6/configure
|--- php-5.1.6/configure        2006-08-23 14:55:02.000000000 +0200
|+++ suhosin-patch-5.1.6-0.9.6/configure        2006-10-27 12:24:35.000000000 +0200
--------------------------
File to patch:

 

I've double checked that all my versions of Suhosin and PHP are correct and dependencies are resolved and still can't figure out why this error is occurring.  Thanks for any help.