The best security ?

[Logical]

What is everybodys oppinion of the best security to use on a PHP site ?

I hear Sentinel is quite good. !

[evilghost]

I actually prefer Suhosin as Stephen Esser is the developer of the extension ad was an active developer on the PHP team prior to him leaving due to PHP's lackadaisical approach to security.

[wnd]

[Logical]

Originally Posted by evilghost

I actually prefer Suhosin as Stephen Esser is the developer of the extension ad was an active developer on the PHP team prior to him leaving due to PHP's lackadaisical approach to security.

Thx evilghost, i'll take a look at it.

[bugmeplz]

.

[pross]

i run suhosin and suPHP with a good set of mod_security rules... suPHP is the important thing though, it makes php run as the user who owns the files not nobody (mod_php) makes tracking spam/exploits easier.

[evilghost]

I wanted to add mod_chroot as an option as well for a layered security approach. If the webserver is compromised the system won't be if there's a properly chrooted environment.

One thing to note, PHP's mail() function depends on sendmail and/or other binary. The system() and other shell functions depend on a working shell. I statically compiled mini_sendmail for the chrooted environment. I also use busybox-static from the repo's hardlinked into the chrooted environment.