Maximum Security

robinjohn

Hi everyone,
this isn't really a question that deals 100% with PHP but I thought I'd ask it anyway:

How far can security be taken using PHP MySQL and Apache?
Does anyone have a link that talks about this topic?

What's the strongest kind of security any of you guys have implemented?

Cheers,
Robin.

trooper

What exactly do you mean ?

One way of totally maximising your security could be to use a combination of the following:

.htaccess (Apache)
Minimal user rights (Mysql)
encrypted session values (PHP)

HTH

robinjohn

I'm still a novice at this, as a result I'm just curious as to what is out there.

.htaccess (Apache)
Minimal user rights (Mysql)
encrypted session values (PHP)

SSL...allows the user to claim legitimacy.
SSH....for encrypting information over the internet

It's the old story about knowing there are similar techs out there, just not knowing what they're called and so not know where to look.

What other techs that deal with the PHP,MySQL and Apsche are
out there that members of this MsgBoard have used?

khaine

I use mod_ssl and open_ssl to secure a website these are both freebies but the certificate for the server can be a little expensive. However it does allow for very strong encyption which can then be used via php to make your website very secure.

Mark.

robinjohn

Don't suppose you've got a good link sitting in your bookmarks that deals with PHP and it's usage of mod_ssl and open_ssl?

Not so much info about the modules themselves, but how php can use them etc?

khaine

Its not really php that uses them its more the server. When configured with ssl the apache server sends data encrypted and has a large number of server variables available that can be used by a php script to ensure that the client connection is who they say they are. For example a ssl certificate contains a variable $SSL_CLIENT_S_DN_CN, The scripts I use call this variable to validate a database query. Any data which the client can see has the same unique id on it. Anyone with no certificate will not generate the SSL_CLIENT_S_DN_CN variable and will be redirected to a different page.

have a look at

http://www.openssl.org/
http://www.modssl.org/

These pretty much cover the whole thing. As to the strength of the security. The server I run with these on has resisted penetration testing by a professional hacking company. There coulden't get in so I'd say its very safe.

One thing you do have to do is make sure any default logins to databases or default certificates are removed. These are open doors to a hacker.

Mark.