summaryrefslogtreecommitdiff
path: root/doc/source/faq.rst
diff options
context:
space:
mode:
authorjvoisin2017-09-26 17:57:30 +0200
committerjvoisin2017-09-26 17:57:30 +0200
commit3040b02639bd71dbcd936311546ef9296165aea5 (patch)
tree871173e901c04255de595653b8e1dc237a675b51 /doc/source/faq.rst
parent3c14dba94e837322e030b19b41654952624cb485 (diff)
Update a bit the configuration
Diffstat (limited to 'doc/source/faq.rst')
-rw-r--r--doc/source/faq.rst27
1 files changed, 17 insertions, 10 deletions
diff --git a/doc/source/faq.rst b/doc/source/faq.rst
index cd9dfe3..09cb244 100644
--- a/doc/source/faq.rst
+++ b/doc/source/faq.rst
@@ -36,13 +36,14 @@ Like PHP's `ElePHPant <https://secure.php.net/elephpant.php>`_,
36we thought that using an elephant as a mascot would be a great idea. 36we thought that using an elephant as a mascot would be a great idea.
37 37
38 38
39Why did you write Snuffleupagus? 39Who are you and why did you write Snuffleupagus?
40"""""""""""""""""""""""""""""""" 40""""""""""""""""""""""""""""""""""""""""""""""""
41 41
42We're working for `NBS System <https://nbs-system.com/en/>`__, 42We're working for `NBS System <https://nbs-system.com/en/>`__,
43a web hosting company (meaning that we're dealing with PHP code all day long), 43a web hosting company (meaning that we're dealing with PHP code all day long),
44with a strong focus on security. We do have hardening 44with a strong focus on security. We do have hardening
45(kernel, `WAF <https://naxsi.org>`_, `IDS <https://en.wikipedia.org/wiki/Intrusion_detection_system>`_, …) 45(`kernel <https://grsecurity.net/>`_, `WAF <https://naxsi.org>`_,
46`IDS <https://en.wikipedia.org/wiki/Intrusion_detection_system>`_, …)
46below the web stack, but most of the time, when a website is compromised, 47below the web stack, but most of the time, when a website is compromised,
47it's either to send ads, spam, deface it, steal data, … 48it's either to send ads, spam, deface it, steal data, …
48This is why we need to harden the website itself too, but we can't touch its 49This is why we need to harden the website itself too, but we can't touch its
@@ -60,7 +61,8 @@ We're huge fans of `Suhosin <https://suhosin.org>`_, unfortunately:
60 61
61We're using the `disable_function <https://secure.php.net/manual/en/ini.core.php#ini.disable-functions>`_ 62We're using the `disable_function <https://secure.php.net/manual/en/ini.core.php#ini.disable-functions>`_
62directive, but unfortunately, it doesn't provide enough usable granularity (guess how many CMS are using 63directive, but unfortunately, it doesn't provide enough usable granularity (guess how many CMS are using
63``system`` to do various mandatory maintenance tasks…). 64the `system <https://secure.php.net/manual/en/function.system.php#refsect1-function.system-notes>`_
65function to perform various mandatory maintenance tasks…).
64 66
65This is why we decided to write our own hardening module, in the spirit of Suhosin, 67This is why we decided to write our own hardening module, in the spirit of Suhosin,
66via virtual-patching support, and other cool new features. 68via virtual-patching support, and other cool new features.
@@ -91,8 +93,8 @@ How mature is this project?
91""""""""""""""""""""""""""" 93"""""""""""""""""""""""""""
92 94
93This project was floating around since early 2016, and we did the first commit 95This project was floating around since early 2016, and we did the first commit
94the 28ᵗʰ of December of the same year. We're currently in a private alpha phase, 96the 28ᵗʰ of December of the same year. We're currently in an alpha phase,
95finding and fixing as much bugs as possible with the help of friends. 97finding and fixing as much bugs as possible before the beta.
96 98
97Are you saying that PHP isn't secure? 99Are you saying that PHP isn't secure?
98""""""""""""""""""""""""""""""""""""" 100"""""""""""""""""""""""""""""""""""""
@@ -108,6 +110,9 @@ issues, as stated in their `documentation <https://wiki.php.net/security#not_a_s
108We do think that an security issue that "requires the use of code or settings known to be insecure" 110We do think that an security issue that "requires the use of code or settings known to be insecure"
109is still a security issue, and should be treated as such. 111is still a security issue, and should be treated as such.
110 112
113We don't have the pretention to state that Snuffleupagus will magically solve
114all your security issues, but we believe that it might definitely help.
115
111Installation and configuration 116Installation and configuration
112------------------------------ 117------------------------------
113 118
@@ -115,8 +120,10 @@ Can snuffleupagus break my application?
115""""""""""""""""""""""""""""""""""""""" 120"""""""""""""""""""""""""""""""""""""""
116Yes. 121Yes.
117 122
118Some options won't break anything, like ``harden_rand``, but some like ``global_strict`` 123Some options won't break anything, like :ref:`harden-rand <harden-rand-feature>`,
119or overly-restrictives virtual-patching rules might pretty well break your website. 124but some like :ref:`global_strict <global-strict-feature>`
125or overly-restrictives :ref:`virtual-patching<virtual-patching-feature>`
126rules might pretty well break your website.
120It's up to you to configure Snuffleupaggus accordingly to your needs. 127It's up to you to configure Snuffleupaggus accordingly to your needs.
121 128
122You can also enable the ``simulation`` mode on features that you're not sure about, 129You can also enable the ``simulation`` mode on features that you're not sure about,
@@ -130,7 +137,7 @@ By checking the logs; Snuffleupagus systematically prefix them with ``[snuffleup
130 137
131Does Snuffleupagus run on Windows? 138Does Snuffleupagus run on Windows?
132"""""""""""""""""""""""""""""""""" 139""""""""""""""""""""""""""""""""""
133No idea. 140No idea, feel free to `try <https://github.com/nbs-system/snuffleupagus/issues/2>`_.
134 141
135 142
136Will Snuffleupagus run on my old PHP 5? 143Will Snuffleupagus run on my old PHP 5?
@@ -206,7 +213,7 @@ Where can I find even more help?
206"""""""""""""""""""""""""""""""" 213""""""""""""""""""""""""""""""""
207The :doc:`configuration page <config>` might be what you're looking for. 214The :doc:`configuration page <config>` might be what you're looking for.
208If you're adventurous, you can also check the `issue tracker <https://github.com/nbs-system/snuffleupagus/issues/?q=is%3Aissue>`_ 215If you're adventurous, you can also check the `issue tracker <https://github.com/nbs-system/snuffleupagus/issues/?q=is%3Aissue>`_
209(make sure to check the closed issues too). 216(make sure to check the `closed issues <https://github.com/nbs-system/snuffleupagus/issues?q=is%3Aissue+is%3Aclosed>`_ too).
210 217
211I need professional support for my company. 218I need professional support for my company.
212""""""""""""""""""""""""""""""""""""""""""" 219"""""""""""""""""""""""""""""""""""""""""""