2.9K

Suhosin is an advanced security protection system designed for PHP installations. It helps secure PHP applications and servers against known and unknown vulnerabilities by adding additional protection layers to the PHP core and runtime environment.

Suhosin is widely used by server administrators to improve PHP security, harden web hosting environments, and reduce the risk of exploitation caused by insecure PHP scripts.

What is Suhosin?

Suhosin is a security system developed specifically for PHP. The primary goal of Suhosin is to protect servers and websites from vulnerabilities in both PHP applications and the PHP core itself.

The name “Suhosin” comes from a Korean word meaning “guardian angel,” which reflects its role in securing PHP environments.

Suhosin consists of two independent parts:

1. PHP Core Patch

The first component is a patch applied directly to the PHP core.

This patch provides low-level protections against:

• Buffer overflows
• Format string vulnerabilities
• Memory corruption attacks
• Internal PHP security flaws

These protections strengthen PHP at the core level.

2. PHP Extension

The second component is a powerful PHP extension that provides additional security features and runtime protections.

The extension includes:

• Script execution protection
• Function filtering
• Logging and monitoring
• Request filtering
• Transparent encryption support
• Session security improvements

This makes Suhosin a comprehensive PHP hardening solution.

Installing Suhosin

Follow the steps below to install the Suhosin extension.

Step 1: Download the Suhosin Source Package

Move to the desired directory and download the Suhosin package.

cd /usr/local/
wget http://www.hardened-php.net/suhosin/suhosin-0.9.18.tgz

Step 2: Extract the Package

tar -zxvf suhosin-0.9.18.tgz

Step 3: Enter the Suhosin Directory

cd suhosin-0.9.18

Step 4: Prepare the PHP Extension Build

phpize

Step 5: Configure and Compile Suhosin

./configure
make
make install

Step 6: Copy the Extension File

Copy the suhosin.so file to the PHP extension directory if required.

Example:

cp modules/suhosin.so /usr/lib/php/extensions

Checking PHP Configuration

To verify the active php.ini file location, run:

php -i | grep php.ini

Example output:

Configuration File (php.ini) Path => /usr/local/Zend/etc/php.ini

Edit php.ini File

Open the PHP configuration file:

vi /usr/local/Zend/etc/php.ini

Configure Suhosin in php.ini

Step 1: Verify Extension Directory

Search for:

extension_dir

Example configuration:

extension_dir = /usr/lib/php/extensions

This directory should contain the suhosin.so extension file.

Step 2: Enable the Suhosin Extension

Add the following line under dynamic extensions:

extension=suhosin.so

Save the file after making the changes.

Advanced Suhosin Configuration

Suhosin provides several advanced configuration options, including:

• Logging Configuration
• Executor Options
• Miscellaneous Security Settings
• Transparent Encryption
• Filtering Options
• Function Restrictions
• Request Filtering

These options allow administrators to customize PHP security policies based on server requirements.

Advantages of Suhosin

Suhosin offers several benefits for PHP security.

1. Improved PHP Protection

It adds additional security layers to PHP applications and the PHP engine itself.

2. No Need to Run Apache as CGI

Suhosin works without requiring Apache to run as CGI, simplifying deployment.

3. Better Function Control

Administrators can:

• Control disable_functions per user
• Configure open_basedir restrictions
• Restrict dangerous PHP behavior

4. Enhanced Monitoring

Suhosin includes logging features that help detect suspicious activity and attacks.

Disadvantages of Suhosin

Although Suhosin improves security, there are some limitations.

1. PHP Version Compatibility

Some PHP versions may require recompilation if versioning is enabled.

2. Zend Optimizer Compatibility

If using Zend Optimizer, ensure version 3.2.1 or later is installed.

3. Strict Security Rules

Suhosin security settings can sometimes block safe or useful PHP functions.

This may cause compatibility issues with certain applications.

Verifying Suhosin Installation

Run the following command:

php -v

Example output:

PHP 4.4.6 (cli)

with Zend Extension Manager v1.2.0

with Suhosin v0.9.18

with Zend Optimizer v3.2.2

If Suhosin appears in the output, the installation is successful.

Note for 64-bit OS Users

For 64-bit operating systems, ensure the correct extension directory is configured in php.ini.

Example:

extension_dir = /usr/lib64/php4

Incorrect extension paths may prevent Suhosin from loading properly.

Conclusion

Suhosin is a powerful security enhancement system for PHP environments. By adding advanced protection mechanisms, it helps secure servers against vulnerabilities, malicious scripts, and unsafe PHP behavior.

With features like function filtering, request protection, logging, and PHP hardening, Suhosin remains a valuable tool for administrators looking to improve PHP security and server stability.

If you require help, contact SupportPRO Server Admin