Suhosin

[wolfstream]

Originally Posted by TECK

Take off Suhosin, it is designed to slowdown your server.
Why do you need a hardened PHP version? Just define a good set of rules in Selinux.

That's a load if I ever heard it.

php, by default has many flaws to it, such as allowing globals to be lax, allowing for poor coding. Obviously, something needs to be done there.

SElinux should be disabled, it's the linux version of "Cancel or allow", only more strict, more of a pain in the tail, and more problematic. If you want to spend hours learning and creating rulesets for selinux, then by all means, go for it. Others aren't going to bother.

There's a reason selinux is disabled by default with every major control panel install out there. That reason? It doesn't work, it's too restrictive, and it is just aweful.

Now, suhosin, on the other hand, I have never, EVER had an issue with when properly compiled into php. Don't use the module, use the patch. Compile php from the ground up, add in the suhosin patch, and any of the mailheader patches, and you'll be fine. Again, I've never, ever seen any problems with this setup, and I manage servers (and forums) that are pretty heavily used and modified.