PHP Secure Configuration Checker

Short intro to Sektioneins' PCC

Transcript

1. PHP Secure Configuration Checker Philipp Krenn, @xeraa
2. https://github.com/ sektioneins/pcc SektionEins (Suhoshin) PHP 5.4+ New BSD License
3. Security Checks Critical: Fix this NOW Example: Register globals
4. Security Checks High: You should really look at this Example: Allow URL fopen
5. Security Checks Medium: This might be a problem Example: Display errors on
6. Security Checks Low: Boring stuff Example: Execution time > 300s
7. Security Checks Maybe: Not sure, check manually Example: Memory limit > 128MB
8. Security Checks Comment: Just mentioning it Example: Upload max filesize is the default (8MB)
9. Modes CLI Web
10. Web Security 127.0.0.1 mtime < 2d
11. How good / bad are the Ubuntu 14.04 defaults? nginx + PHP-FPM
13. Give It a Try $ git clone https://github.com/xeraa/ppc-test.git $ cd ppc-test/ $ vagrant up http://127.0.0.1:8080/phpconfigcheck-allow.php
14. Conclusion: Simple but gets the job done
15. Questions?