Upgrade to Pro — share decks privately, control downloads, hide ads and more …

PHP Secure Configuration Checker

Avatar for Philipp Krenn Philipp Krenn
September 08, 2014
Programming
1
430

PHP Secure Configuration Checker

Short intro to Sektioneins' PCC
Avatar for Philipp Krenn

Philipp Krenn

September 08, 2014
Tweet

More Decks by Philipp Krenn

See All by Philipp Krenn
Full-Text Search Explained
Avatar for Philipp Krenn xeraa
11
2.2k
360° Monitoring of Your Microservices
Avatar for Philipp Krenn xeraa
7
3.4k
Scale Your Metrics with Elasticsearch
Avatar for Philipp Krenn xeraa
4
140
YAML Considered Harmful
Avatar for Philipp Krenn xeraa
0
2.1k
Scale Your Elasticsearch Cluster
Avatar for Philipp Krenn xeraa
1
310
Hands-On ModSecurity and Logging
Avatar for Philipp Krenn xeraa
2
190
Centralized Logging Patterns
Avatar for Philipp Krenn xeraa
1
1.1k
Dashboards for Your Management with Kibana Canvas
Avatar for Philipp Krenn xeraa
1
470
Make Your Data FABulous
Avatar for Philipp Krenn xeraa
3
890

Other Decks in Programming

See All in Programming
What Spring Developers Should Know About Jakarta EE
Avatar for ivargrimstad ivargrimstad
0
180
Effect の双対、Coeffect
Avatar for ゆきくらげ yukikurage
5
1.4k
iOSアプリ開発で 関数型プログラミングを実現する The Composable Architectureの紹介
Avatar for yimajo yimajo
2
210
明示と暗黙 ー PHPとGoの インターフェイスの違いを知る
Avatar for shimabox shimabox
2
260
Is Xcode slowly dying out in 2025?
Avatar for 上ちょ / uetyo uetyo
1
190
Bytecode Manipulation 으로 생산성 높이기
Avatar for Daekyu bigstark
2
370
GoのWebAssembly活用パターン紹介
Avatar for syumai syumai
3
10k
型付きアクターモデルがもたらす分散シミュレーションの未来
Avatar for Takatomo Torigoe piyo7
0
800
PostgreSQLのRow Level SecurityをPHPのORMで扱う Eloquent vs Doctrine #phpcon #track2
Avatar for Hiromi Hishida 77web
2
270
Create a website using Spatial Web
Avatar for Akio Itaya akkeylab
0
300
20250628_非エンジニアがバイブコーディングしてみた
Avatar for ponponmikan ponponmikankan
0
310
Webの外へ飛び出せ NativePHPが切り拓くPHPの未来
Avatar for Takuya Katsusa takuyakatsusa
2
300

Featured

See All Featured
Agile that works and the tools we love
Avatar for Rasmus Luckow-Nielsen rasmusluckow
329
21k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
Avatar for Michelle Schulp Hunt marktimemedia
31
2.4k
YesSQL, Process and Tooling at Scale
Avatar for Rocio Delgado rocio
173
14k
No one is an island. Learnings from fostering a developers community.
Avatar for Antonio thoeni
21
3.3k
Balancing Empowerment & Direction
Avatar for Lara Hogan lara
1
350
How to train your dragon (web standard)
Avatar for Monica Dinculescu notwaldorf
92
6.1k
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
126
17k
Adopting Sorbet at Scale
Avatar for Ufuk Kayserilioglu ufuk
77
9.4k
Typedesign – Prime Four
Avatar for Hannes Fritz hannesfritz
42
2.7k
The Art of Programming - Codeland 2020
Avatar for Erika Heidi erikaheidi
54
13k
Building a Scalable Design System with Sketch
Avatar for Laura Van Doore lauravandoore
462
33k
Done Done
Avatar for chrislema chrislema
184
16k

Transcript

  1. PHP Secure Configuration Checker Philipp Krenn, @xeraa

  2. https://github.com/ sektioneins/pcc SektionEins (Suhoshin) PHP 5.4+ New BSD License

  3. Security Checks Critical: Fix this NOW Example: Register globals

  4. Security Checks High: You should really look at this Example:

    Allow URL fopen

  5. Security Checks Medium: This might be a problem Example: Display

    errors on

  6. Security Checks Low: Boring stuff Example: Execution time > 300s

  7. Security Checks Maybe: Not sure, check manually Example: Memory limit

    > 128MB

  8. Security Checks Comment: Just mentioning it Example: Upload max filesize

    is the default (8MB)

  9. Modes CLI Web

  10. Web Security 127.0.0.1 mtime < 2d

  11. How good / bad are the Ubuntu 14.04 defaults? nginx

    + PHP-FPM
  12. None

  13. Give It a Try $ git clone https://github.com/xeraa/ppc-test.git $ cd

    ppc-test/ $ vagrant up http://127.0.0.1:8080/phpconfigcheck-allow.php

  14. Conclusion: Simple but gets the job done

  15. Questions?