summaryrefslogtreecommitdiff
path: root/stories/install.html
diff options
context:
space:
mode:
authorBen Fuhrmannek2021-02-11 11:09:44 +0100
committerBen Fuhrmannek2021-02-11 11:09:44 +0100
commitb738e6593378c112b903f03961af11f988e3fca5 (patch)
tree69bc09fc84e0f72df46b5785b529f11ba1aa922b /stories/install.html
.
Diffstat (limited to 'stories/install.html')
-rw-r--r--stories/install.html333
1 files changed, 333 insertions, 0 deletions
diff --git a/stories/install.html b/stories/install.html
new file mode 100644
index 0000000..9f298a4
--- /dev/null
+++ b/stories/install.html
@@ -0,0 +1,333 @@
1<!DOCTYPE html>
2<html prefix="og: http://ogp.me/ns# article: http://ogp.me/ns/article#
3" lang="en">
4<head>
5<meta charset="utf-8">
6<meta name="viewport" content="width=device-width, initial-scale=1">
7<title>Installing Suhosin | SUHOSIN</title>
8<link href="../assets/css/all-nocdn.css" rel="stylesheet" type="text/css">
9<meta name="theme-color" content="#5670d4">
10<meta name="generator" content="Nikola (getnikola.com)">
11<link rel="canonical" href="https://suhosin.org/stories/install.html">
12<link rel="icon" href="../favicon.png" sizes="32x32">
13<link rel="icon" href="../favicon_256x256.png" sizes="256x256">
14<!--[if lt IE 9]><script src="../assets/js/html5.js"></script><![endif]--><meta name="author" content="SektionEins">
15<meta property="og:site_name" content="SUHOSIN">
16<meta property="og:title" content="Installing Suhosin">
17<meta property="og:url" content="https://suhosin.org/stories/install.html">
18<meta property="og:description" content="Contents
19
20Introduction
21Suhosin Extension
22Manual Installation
23Installing on Debian and Ubuntu
24Installing on Gentoo
25Installing on FreeBSD
26
27
28Suhosin-Patch
29Step 1: Installing the Hardened-PHP Project Sign">
30<meta property="og:type" content="article">
31<meta property="article:published_time" content="2014-06-11T11:02:00+02:00">
32</head>
33<body>
34<a href="#content" class="sr-only sr-only-focusable">Skip to main content</a>
35
36<!-- Menubar -->
37
38<nav class="navbar navbar-expand-md static-top mb-4
39navbar-dark bg-dark
40"><div class="container">
41<!-- This keeps the margins nice -->
42 <a class="navbar-brand" href="https://suhosin.org/">
43
44 <span id="blog-title">SUHOSIN</span>
45 </a>
46 <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#bs-navbar" aria-controls="bs-navbar" aria-expanded="false" aria-label="Toggle navigation">
47 <span class="navbar-toggler-icon"></span>
48 </button>
49
50 <div class="collapse navbar-collapse" id="bs-navbar">
51 <ul class="navbar-nav mr-auto">
52<li class="nav-item">
53<a href="download.html" class="nav-link">Download</a>
54 </li>
55<li class="nav-item dropdown">
56<a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">Documentation</a>
57 <div class="dropdown-menu">
58 <a href="feature-list.html" class="dropdown-item">Feature List</a>
59 <a href="#" class="dropdown-item active">Installing Suhosin <span class="sr-only">(active)</span></a>
60 <a href="configuration.html" class="dropdown-item">Configuration</a>
61 <a href="howtos.html" class="dropdown-item">HOWTOs</a>
62 <a href="faq.html" class="dropdown-item">FAQ</a>
63 <a href="benchmark.html" class="dropdown-item">Benchmark</a>
64 </div>
65 </li>
66<li class="nav-item dropdown">
67<a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">Github</a>
68 <div class="dropdown-menu">
69 <a href="https://raw.githubusercontent.com/sektioneins/suhosin/master/Changelog" class="dropdown-item">Changelog</a>
70 <a href="https://github.com/sektioneins/suhosin" class="dropdown-item">Sources</a>
71 <a href="https://github.com/sektioneins/suhosin/issues" class="dropdown-item">Bugtracker</a>
72 </div>
73 </li>
74<li class="nav-item dropdown">
75<a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">SektionEins</a>
76 <div class="dropdown-menu">
77 <a href="https://sektioneins.de/en/index.html#services" class="dropdown-item">Security Audits</a>
78 <a href="https://sektioneins.de/en/index.html#news" class="dropdown-item">News</a>
79 <a href="https://sektioneins.de/en/kontakt.html" class="dropdown-item">Contact</a>
80 </div>
81
82
83 </li>
84</ul>
85<ul class="navbar-nav navbar-right"></ul>
86</div>
87<!-- /.navbar-collapse -->
88 </div>
89<!-- /.container -->
90</nav><!-- End of Menubar --><div class="container" id="content" role="main">
91 <div class="body-content">
92 <!--Body content-->
93
94
95<article class="post-text storypage" itemscope="itemscope" itemtype="http://schema.org/Article"><header><h1 class="p-name entry-title" itemprop="headline name"><a href="#" class="u-url">Installing Suhosin</a></h1>
96
97
98
99 </header><div class="e-content entry-content" itemprop="articleBody text">
100 <div>
101<div class="contents alert alert-info pull-right topic" id="contents">
102<p class="topic-title first">Contents</p>
103<ul class="simple">
104<li><a class="reference internal" href="install.html#introduction" id="id1">Introduction</a></li>
105<li>
106<a class="reference internal" href="install.html#suhosin-extension" id="id2">Suhosin Extension</a><ul>
107<li><a class="reference internal" href="install.html#manual-installation" id="id3">Manual Installation</a></li>
108<li><a class="reference internal" href="install.html#installing-on-debian-and-ubuntu" id="id4">Installing on Debian and Ubuntu</a></li>
109<li><a class="reference internal" href="install.html#installing-on-gentoo" id="id5">Installing on Gentoo</a></li>
110<li><a class="reference internal" href="install.html#installing-on-freebsd" id="id6">Installing on FreeBSD</a></li>
111</ul>
112</li>
113<li>
114<a class="reference internal" href="install.html#suhosin-patch" id="id7">Suhosin-Patch</a><ul>
115<li><a class="reference internal" href="install.html#step-1-installing-the-hardened-php-project-signaturekey" id="id8">Step 1: Installing the Hardened-PHP Project Signaturekey</a></li>
116<li><a class="reference internal" href="install.html#step-2-downloading-and-verifying-the-necessary-files" id="id9">Step 2: Downloading and verifying the necessary files</a></li>
117<li><a class="reference internal" href="install.html#installing-on-a-generic-linux-unix" id="id10">Installing on a Generic Linux/Unix</a></li>
118</ul>
119</li>
120<li><a class="reference internal" href="install.html#upgrading" id="id11">Upgrading</a></li>
121</ul>
122</div>
123<div class="section" id="introduction">
124<h2><a class="toc-backref" href="install.html#id1">Introduction</a></h2>
125<p>Suhosin comes with two parts - the extension and the patch. Both parts can be installed separately and have no dependencies to each other.</p>
126</div>
127<div class="section" id="suhosin-extension">
128<h2><a class="toc-backref" href="install.html#id2">Suhosin Extension</a></h2>
129<p>Compatibility: The current Suhosin-Extension has been tested with PHP 5.4, 5.5 and 5.6.</p>
130<div class="section" id="manual-installation">
131<h3><a class="toc-backref" href="install.html#id3">Manual Installation</a></h3>
132<p>Unlike the Hardening-Patch for PHP, nearly all of Suhosin's features are within the extension. Therefore you might want to only install the extension and use a plain unpatched PHP. Depending on the system we might already offer binary packages. You can check our <a class="reference external" href="download.html">Suhosin Download</a> page. In that case you only need to activate the extension inside your php.ini and maybe add Configuration directives if you are not satisfied by the default values.</p>
133<p>Before you continue compiling the Suhosin-Extension you should verify the file integrity with GnuPG or download the latest source from Github via HTTPS. The next step is unpacking the extension tarball and performing the usual compilation steps for PHP extensions.</p>
134<p>Quickstart (probably suitable for most people):</p>
135<pre class="literal-block">
136#&gt; cd suhosin
137#&gt; phpize
138#&gt; ./configure
139#&gt; make
140#&gt; make install
141</pre>
142<p>This should install suhosin.so in the correct extension directory. The final step is adding a load directive to php.ini</p>
143<pre class="literal-block">
144extension=suhosin.so
145</pre>
146<p>and optionally add some configuration directives in case you do not like the default values.</p>
147<p>More elaborate configuration (for advanced users with several PHP installations):</p>
148<ul>
149<li>
150<p class="first"><tt class="docutils literal">#&gt; phpize</tt> should be the <tt class="docutils literal">phpize</tt> from your target PHP installation - in case you have more than one PHP installed. So this may actually be something like</p>
151<pre class="literal-block">
152#&gt; /opt/php-5.6.2/bin/phpize
153</pre>
154</li>
155<li>
156<p class="first">Point to the correct <tt class="docutils literal"><span class="pre">php-config</span></tt>! If either <tt class="docutils literal">phpize</tt> or <tt class="docutils literal"><span class="pre">php-config</span></tt> does not belong to your target PHP, you may encounter strange errors such as <tt class="docutils literal">undefined symbol compiler_globals</tt>.</p>
157<pre class="literal-block">
158#&gt; ./configure --with-php-config=/opt/php-5.6.2/bin/php-config
159</pre>
160</li>
161<li>
162<p class="first">CFLAGS: these may be added to <tt class="docutils literal">configure</tt> as well. e.g.</p>
163<pre class="literal-block">
164#&gt; configure CFLAGS="-arch x86_64
165</pre>
166</li>
167<li>
168<p class="first">Some experimental features can be enabled using</p>
169<pre class="literal-block">
170#&gt; configure --enable-suhosin-experimental
171</pre>
172</li>
173<li>
174<p class="first"><tt class="docutils literal">#&gt; make <span class="pre">-j2</span></tt> - for speed. Add CFLAGS here too as needed, e.g. <tt class="docutils literal">make <span class="pre">-j2</span> <span class="pre">CFLAGS="..."</span></tt></p>
175</li>
176<li>
177<p class="first"><tt class="docutils literal">#&gt; make install</tt> or just copy suhosin.so to your <tt class="docutils literal">extension_dir</tt>.</p>
178</li>
179</ul>
180</div>
181<div class="section" id="installing-on-debian-and-ubuntu">
182<h3><a class="toc-backref" href="install.html#id4">Installing on Debian and Ubuntu</a></h3>
183<ul>
184<li>
185<p class="first"><strong>Option 1</strong>: Compile a .deb package yourself: (replace version number as appropriate)</p>
186<pre class="literal-block">
187suhosin/pkg $ ./build_deb.sh 0.9.37-1~custom1
188</pre>
189</li>
190<li>
191<p class="first"><strong>Option 2</strong>: We provide precompiled packages of Suhosin's bleeding edge - yet stable enough - development version for Debian (wheezy and jessie / amd64, i386, armhf) and Ubuntu (stable / amd64). <em>Note</em>: This service is free of charge and comes without any warranty. These packages are not recommended for production. Also, please note that Suhosin was compiled depending on stock PHP5 packages; users of custom PHP repositories such as dotdeb should use Option 1.</p>
192<pre class="literal-block">
193## /etc/apt/sources.list for Debian jessie (stable) (amd64, i386, armhf)
194deb http://repo.suhosin.org/ debian-jessie main
195
196## /etc/apt/sources.list for Debian wheezy (old stable) (amd64, i386, armhf)
197deb http://repo.suhosin.org/ debian-wheezy main
198
199## /etc/apt/sources.list for Ubuntu trusty (amd64 only)
200deb http://repo.suhosin.org/ ubuntu-trusty main
201</pre>
202<p>Then <em>apt-get install php5-suhosin-extension</em>.</p>
203<p>The repository is signed with our archive key <a class="reference external" href="https://sektioneins.de/files/repository.asc">0xB12D0447319F1ADB</a>.</p>
204<pre class="literal-block">
205$ wget https://sektioneins.de/files/repository.asc
206$ sudo apt-key add repository.asc
207</pre>
208</li>
209<li>
210<p class="first"><strong>Option 3</strong>: Debian provides official Suhosin packages for some Versions, e.g. sid, named <em>php5-suhosin</em>. These are ok as well, but most likely not the latest version. Suhosin is in constant development to keep up to date with modern web attacks. If possible, use Option 1 or 2 instead.</p>
211</li>
212</ul>
213</div>
214<div class="section" id="installing-on-gentoo">
215<h3><a class="toc-backref" href="install.html#id5">Installing on Gentoo</a></h3>
216<p>Installing and using Suhosin on Gentoo is very easy. At the moment the Suhosin patches and extensions are only available in the external PHP Overlay, and not yet in the Portage tree, you can expect them to also be available in the main Portage tree during October 2006. Let’s install the PHP Overlay then:</p>
217<pre class="literal-block">
218#&gt; emerge layman
219#&gt; layman -f
220#&gt; layman -a php-testing
221</pre>
222<p>Now let’s install PHP with the Suhosin patch and extension:</p>
223<pre class="literal-block">
224#&gt; echo "dev-lang/php" &gt;&gt; /etc/portage/package.keywords
225(unstable version needed)
226#&gt; USE="suhosin" emerge =php-4* for PHP4, or =php-5* for PHP5
227</pre>
228<p>(NOTE: you cannot also have the "hardenedphp" USE flag enabled at the same time!)
229That’s it, your PHP on Gentoo is now running with the Suhosin patch enabled, and the Suhosin extension was automatically installed (from the dev-php{4,5}/suhosin package).</p>
230</div>
231<div class="section" id="installing-on-freebsd">
232<h3><a class="toc-backref" href="install.html#id6">Installing on FreeBSD</a></h3>
233<p>The Suhosin-Patch and the Suhosin extension are both within the FreeBSD ports. Therefore installing it on FreeBSD is very simple. The Suhosin-Patch is an option which you can choose when you install the lang/php4 or lang/php5 port. To install the patch just do</p>
234<pre class="literal-block">
235#&gt; cd /usr/ports/lang/php5
236#&gt; make
237... now select the menu item that says: Enable Suhosin Protection
238#&gt; make install
239</pre>
240<p>To install the extension just do</p>
241<pre class="literal-block">
242#&gt; cd /usr/ports/security/php-suhosin
243#&gt; make
244#&gt; make install
245</pre>
246<p>After these simple steps Suhosin-Patch is successfully installed on your system.</p>
247</div>
248</div>
249<div class="section" id="suhosin-patch">
250<h2><a class="toc-backref" href="install.html#id7">Suhosin-Patch</a></h2>
251<p><strong>Note:</strong> The Suhosin-Patch is compatible only up to PHP version <strong>5.3.9</strong>. You can, however, run the Suhosin-Extension without the Suhosin-Patch with current version of PHP5.</p>
252<p>When you want to install PHP with the Suhosin-Patch you have to perform some preparation steps first.</p>
253<div class="section" id="step-1-installing-the-hardened-php-project-signaturekey">
254<h3><a class="toc-backref" href="install.html#id8">Step 1: Installing the Hardened-PHP Project Signaturekey</a></h3>
255<p>You should first grab a copy of the Hardened-PHP Project's Release Signaturekey and import it into your GNU Privacy Guard keychain. (For further information on the usage of gnupg please consult it’s manpage)</p>
256<pre class="literal-block">
257#&gt; gpg --import &lt; hardened-php-signature-key.asc
258gpg: /root/.gnupg/trustdb.gpg: trust-db erzeugt
259gpg: key 0A864AA1: public key "Hardened-PHP Signature Key" imported
260gpg: Anzahl insgesamt bearbeiteter Schlüssel: 1
261gpg: importiert: 1
262</pre>
263</div>
264<div class="section" id="step-2-downloading-and-verifying-the-necessary-files">
265<h3><a class="toc-backref" href="install.html#id9">Step 2: Downloading and verifying the necessary files</a></h3>
266<p>It is now time to grab a copy of a fresh PHP tarball and the latest version of the Suhosin-Patch. Additionally you should get the digital signature (*.sig) files. You can grab all of this on our suhosin download page.</p>
267<p>As a first precaution you can check the MD5 hashs of the downloaded files against those you find on the download page.</p>
268<pre class="literal-block">
269#&gt; md5sum php-5.1.4.tar.bz2
27066a806161d4a2d3b5153ebe4cd0f2e1c php-5.1.4.tar.bz2
271#&gt; md5sum suhosin-patch-5.1.4-0.9.0.patch.gz
272ea9026495c4ce34a329fd0a87474f1ba suhosin-patch-5.1.4-0.9.0.patch.gz
273</pre>
274<p>When the MD5 hash values are valid you can check the digital signatures like this.</p>
275<pre class="literal-block">
276#&gt; gpg php-5.1.4.tar.bz2.sig
277gpg: Signature made Di 16 Mai 2006 23:39:04 CEST using DSA key ID 0A864AA1
278gpg: Good signature from "Hardened-PHP Signature Key"
279#&gt; gpg suhosin-patch-5.1.4-0.9.0.patch.gz.sig
280gpg: Signature made So 21 August 2006 20:02:53 CEST using DSA key ID 0A864AA1
281gpg: Good signature from "Hardened-PHP Signature Key"
282Step 3: Unpacking and Patching
283</pre>
284<p>You now have to unpack the PHP tarball, gunzip the patchfile and then apply the patch.</p>
285<pre class="literal-block">
286#&gt; tar -xfj php-5.1.4.tar.bz2
287#&gt; gunzip suhosin-patch-5.1.4-0.9.0.patch.gz
288#&gt; cd php-5.1.4
289#&gt; patch -p 1 -i ../suhosin-patch-5.1.4-0.9.0.patch
290</pre>
291<p>If you prefer to have suhosin as builtin extension you can also download the suhosin extension source code and copy the src files into the ext/suhosin directory within your PHP source tree.</p>
292</div>
293<div class="section" id="installing-on-a-generic-linux-unix">
294<h3><a class="toc-backref" href="install.html#id10">Installing on a Generic Linux/Unix</a></h3>
295<p>After having prepared the PHP source tree the next step is not much different from the usual installation of PHP. If you have copied the suhosin extension into the ext directory you also have to activate it.</p>
296<pre class="literal-block">
297#&gt; [./buildconf - in case you want to compile suhosin statically]
298#&gt; ./configure --with-whatever-you-want [--enable-suhosin]
299#&gt; make
300#&gt; make test
301#&gt; make install
302</pre>
303<p>By executing make test you can verify, that PHP still works and does not break anything.</p>
304<p>If you are upgrading from a previous installation of PHP you do not need to recompile all installed PHP modules and extensions unless you are upgrading to a PHP version that breaks binary compatibility. However recompiling the extensions after having installed PHP with the Suhosin-Patch can protect them from possible format string vulnerabilities, which was built into the header files.</p>
305<p>After having recompiled and installed everything, have a look at the bundled php.ini files for examples how to use the new configuration directives. For a documentation of the new directives consult the Configuration section.</p>
306<p>Binary extensions from for example Zend should continue flawlessly. If you encounter any problem contact us immediately.</p>
307</div>
308</div>
309<div class="section" id="upgrading">
310<h2><a class="toc-backref" href="install.html#id11">Upgrading</a></h2>
311<p>Upgrading to a new PHP or new Suhosin-Patch version is quite identical to the normal installation process. This is like upgrading a normal PHP. That means, if the binary compatibility was broken between PHP versions you have to recompile all installed PHP modules/extension. Upgrading the Suhosin-Extension on the other hand is as simple as recompiling it (or using a binary), replacing the file and restarting your webserver.</p>
312</div>
313</div>
314 </div>
315
316
317</article><!--End of body content--><footer id="footer"><a href="https://sektioneins.de/en/"><img src="../images/s1-logo-transparent-small.png" id="footerimg"></a><div id="footertext">© 2019 <a href="https://sektioneins.de/en/">SektionEins GmbH</a> • <a href="https://sektioneins.de/en/impressum.html">Imprint</a> • <a href="https://sektioneins.de/en/privacy.html">Privacy Statement</a>
318</div>
319
320 </footer>
321</div>
322</div>
323
324
325 <script src="../assets/js/all-nocdn.js"></script><script>
326 baguetteBox.run('div#content', {
327 ignoreClass: 'islink',
328 captions: function(element) {
329 return element.getElementsByTagName('img')[0].alt;
330 }});
331 </script>
332</body>
333</html>