Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

PHP Secure Configuration Checker

Avatar for Philipp Krenn Philipp Krenn
September 08, 2014
Programming
450
1

PHP Secure Configuration Checker

Short intro to Sektioneins' PCC

Avatar for Philipp Krenn

Philipp Krenn

September 08, 2014

More Decks by Philipp Krenn

See All by Philipp Krenn
Full-Text Search Explained
Avatar for Philipp Krenn xeraa
11
2.4k
360° Monitoring of Your Microservices
Avatar for Philipp Krenn xeraa
7
3.6k
Scale Your Metrics with Elasticsearch
Avatar for Philipp Krenn xeraa
4
180
YAML Considered Harmful
Avatar for Philipp Krenn xeraa
0
2.1k
Scale Your Elasticsearch Cluster
Avatar for Philipp Krenn xeraa
1
380
Hands-On ModSecurity and Logging
Avatar for Philipp Krenn xeraa
2
230
Centralized Logging Patterns
Avatar for Philipp Krenn xeraa
1
1.2k
Dashboards for Your Management with Kibana Canvas
Avatar for Philipp Krenn xeraa
1
520
Make Your Data FABulous
Avatar for Philipp Krenn xeraa
3
1.1k

Other Decks in Programming

See All in Programming
AWS Step Functions 大規模並列の壁を越える / jaws-sonic-2026-niigata-step-functions
Avatar for kasacchiful kasacchiful
PRO
1
500
JPUG勉強会 OSSデータベースの内部構造を理解しよう(第２回)
Avatar for Atsushi Ogawa oga5
0
260
What We Talk About When We Talk About XP
Avatar for seki at druby.org m_seki
2
660
【高い買い物LT会】初任給で話題の国産フィジカルAIを買った話
Avatar for 赤神青空 akagami
PRO
0
160
ハーネス設計入門 〜 基礎知識の整理から実務へのステップアップ 〜
Avatar for kinopee kinopeee
3
1.8k
Are APIs Still Relevant in the AI Era?
Avatar for Antoine Bluchet soyuka
0
280
Vue Fes Japan 2026 タイムテーブル徹底解説
Avatar for 448jp | OKI Yoshiya 448jp
1
410
アクセシビリティから考える情報設計
Avatar for high-g high_g_engineer
0
380
{ Android | Kotlin } Gradle Plugin in 2026
Avatar for RyuNen344 ryunen344
1
330
Kiroで創り、AgentCoreで繋ぐ！AWSで実践する「AI-DLC」から「AIエージェント統合」までの最新地図
Avatar for matsukada licux
4
720
The Past, Present, and Future of Enterprise Java
Avatar for ivargrimstad ivargrimstad
0
490
モバイル交通系ICへのチャージ実例から考える、クロスプラットフォーム開発におけるiOS実機テスト設計とCI運用
Avatar for Yu Sugawara yusuga
1
520

Featured

See All Featured
Design of three-dimensional binary manipulators for pick-and-place task avoiding obstacles (IECON2024)
Avatar for konakalab konakalab
0
600
Accessibility Awareness
Avatar for Sarah Abderemane sabderemane
1
210
The #1 spot is gone: here's how to win anyway
Avatar for Tamara Novitovic tamaranovitovic
4
1.2k
Claude Code どこまでも/ Claude Code Everywhere
Avatar for nwiizo nwiizo
67
58k
Practical Tips for Bootstrapping Information Extraction Pipelines
Avatar for Matthew Honnibal honnibal
25
2.1k
A Tale of Four Properties
Avatar for Chris Coyier chriscoyier
163
24k
The innovator’s Mindset - 
Leading Through an Era of Exponential Change - McGill University 2025
Avatar for Jean-Marc De Jonghe jdejongh
PRO
1
340
Building Flexible Design Systems
Avatar for Yesenia Perez-Cruz yeseniaperezcruz
330
41k
Context Engineering - Making Every Token Count
Avatar for Addy Osmani addyosmani
9
1.1k
Utilizing Notion as your number one productivity tool
Avatar for Mfonobong Umondia mfonobong
4
590
Why You Should Never Use an ORM
Avatar for John Nunemaker jnunemaker
PRO
61
10k
Paper Plane
Avatar for Katie Cordina Lindsey katiecoart
PRO
4
53k

Transcript

  1. PHP Secure Configuration Checker Philipp Krenn, @xeraa

  2. https://github.com/ sektioneins/pcc SektionEins (Suhoshin) PHP 5.4+ New BSD License

  3. Security Checks Critical: Fix this NOW Example: Register globals

  4. Security Checks High: You should really look at this Example:

    Allow URL fopen

  5. Security Checks Medium: This might be a problem Example: Display

    errors on

  6. Security Checks Low: Boring stuff Example: Execution time > 300s

  7. Security Checks Maybe: Not sure, check manually Example: Memory limit

    > 128MB

  8. Security Checks Comment: Just mentioning it Example: Upload max filesize

    is the default (8MB)

  9. Modes CLI Web

  10. Web Security 127.0.0.1 mtime < 2d

  11. How good / bad are the Ubuntu 14.04 defaults? nginx

    + PHP-FPM
  12. None

  13. Give It a Try $ git clone https://github.com/xeraa/ppc-test.git $ cd

    ppc-test/ $ vagrant up http://127.0.0.1:8080/phpconfigcheck-allow.php

  14. Conclusion: Simple but gets the job done

  15. Questions?