Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112844
Message-ID: <A29D858B-D8D9-4298-9EBC-DBF72A640198@benramsey.com>
Content-Type: multipart/signed;
	boundary="Apple-Mail=_546ADFDB-9781-433C-ACB3-60EBB5ECBA7A";
	protocol="application/pgp-signature";
	micalg=pgp-sha256
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.40.0.2.32\))
Date: Mon, 11 Jan 2021 14:45:24 -0600
In-Reply-To: <CACMzB5dBytBHEnQM_wZ07Re-zA-6QrC0LtDyy0mwF6jWA_Gg7g@mail.gmail.com>
Cc: Internals <internals@lists.php.net>
To: Rene Veerman <rene.veerman.netherlands@gmail.com>
References: <CACMzB5dBytBHEnQM_wZ07Re-zA-6QrC0LtDyy0mwF6jWA_Gg7g@mail.gmail.com>
Subject: Re: [PHP-DEV] silly question : what is more secure at the moment,
 php7, php8, or plain .sh shell scripts?
From: ben@benramsey.com (Ben Ramsey)

--Apple-Mail=_546ADFDB-9781-433C-ACB3-60EBB5ECBA7A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

> On Jan 10, 2021, at 02:10, Rene Veerman =
<rene.veerman.netherlands@gmail.com> wrote:
>=20
> hi.
>=20
> i run a website which i want to harden against hacking by 3rd parties.
>=20
> i wrote this website back in 2002-2010, and then built apps on top of =
the
> base code.
>=20
> now i want to upgrade the entire thing to the latest css3 standards =
and
> also include anti-hacking measures, because at one point i got kicked =
off
> the internet by my ISP because they detected the thing had indeed been
> hacked, and someone installed phishing software on my site.
>=20
> i want to employ cron jobs that run regularly, to do checksum testing =
of
> vital parts of my operating system.
>=20
> ideally, i could have a script run indefinitely or every 2 seconds, as
> root, from cron, to test for changes to my filesystem (well, the part =
that
> is governed by Directory section in
> /etc/apache2/sites-enabled/001-localhost.conf) and vital OS config =
files.
> but i do wonder if this is going to wear out the SSD where the OS and
> webserver files are stored on.
> and i wonder if i should be writing this script as some sort of shell
> script (bash? /bin/sh? i dunno (i run ubuntu 20.04)), or if i could be
> using the convenient php for it.
>=20
> and i would like to know if as far as exploits go, it's better to stay
> (currently) on php7.4, or move my entire setup to php8.
>=20
> thanks for your attention and any help you might provide me. :)



For the most recent security fixes, always run the latest version of a =
currently supported version of PHP:
https://www.php.net/supported-versions.php

Currently supported versions are 7.3, 7.4, and 8.0, so you should run =
either 7.3.26, 7.4.14, or 8.0.1.

Many Linux distributions back-port security fixes to earlier versions of =
PHP, so if you=E2=80=99ve installed PHP using a package manager, check =
with the maintainers to ensure your PHP version has the latest security =
updates.

Cheers,
Ben



--Apple-Mail=_546ADFDB-9781-433C-ACB3-60EBB5ECBA7A
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iHUEAREIAB0WIQToXQMR3fpbrPOmEOewLZeYnIwHGwUCX/y45AAKCRCwLZeYnIwH
G94+AP4zoQnL4MSfSnEQZ192aeQDSoxpzcCRWcfVxiw2l4PD5AD8CJEmdZ7se4Rl
u6DASzhWHWPMzZ2RXrgbs492xF59yx8=
=/Nao
-----END PGP SIGNATURE-----

--Apple-Mail=_546ADFDB-9781-433C-ACB3-60EBB5ECBA7A--