Everything
php
Learn Community Releases The PHP Project
Home » Project » Newsgroups » php.internals » Expose php: on or off »

Expose php: on or off

php.internals

Wolfgang Drews

20 years ago
hi list, i just came back from phpconference in frankfurt and had some nice talks there with Ilia and Derick. They told me to send my following thoughts to internals, so that you maybe can find a wise solution for it. as security gets more and more recognized by many people, they do follow all the security-experts suggestions to turn of the exposure of php to OFF, as otherwise this would help hackers to find vulnerabilities on their server (i.e. if you are running an old php-version, which has security-holes). I was told to do so, too, but actually i have a very good reason to let it turned on: Netcraft. as far as i can see it, Netcraft is collecting its numbers from exactly this exposure. Further i think to remember, that in former times everybody told to turn it on - so that Netcraft can count the server as php-server and in result the statistics are doing well for php. Now have a short look at the statistics, and you will see, that we had a degree in domains of about 1.3 million domains last month . i can imagine that a reason for this may be, that a huge provider turned expose_php to off (but who knows). In any case, this makes me aware of a problem: a decision between security and php's spread? my suggestion would be, to simply shorten the string that gets exposed to "php" - and not show any version numbers (or maybe leave it to the user, say 0 for "no exposure", 1 for "only php" and 2 for "php with version number". what do you think? best regards, -Wolfgang
-- PHP-Knotenpunkt Dynamic Web Pages: http://www.dynamicwebpages.de/ Deutschsprachige PHP-Zertifizierungen: http://www.phpzertifizierung.de/ Professionelle Lösungen für dynamisches Webpublishing: http://php-buch.de/

Peter Brodersen

20 years ago
On Thu, 10 Nov 2005 16:13:34 +0100, in php.internals drews@php.net ("Wolfgang Drews") wrote:
>my suggestion would be, to simply shorten the string that gets >exposed to "php" - and not show any version numbers (or maybe leave >it to the user, say 0 for "no exposure", 1 for "only php" and 2 for >"php with version number". > >what do you think?
I suppose attacks could be divided into targeted attacks and wild attacks. The last case (as in all different kinds of worms) has shown us that it is easier to shoot and move on than to determine whether or not a host is vulnerable (why send a HEAD request just to determine whether or not your request could would instead of just sending the malicious GET request at first?). It could be mentioned that some worms such as the ones targeting phpbb used google requests to search for specific versions of phpbb. For phpbb I'm not sure whether omitting the version number would result in a better security track record though :-) Those targeting specific web sites might be able to figure out the approximate version otherwise. The major version of php could be determined in a couple of other ways, such as checking what animal (sorry Thies :-) is present, e.g.: http://www.php.net/cal.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42 and otherwise still try any kind of exploit if the version information is unavailable. People tend to use the default values or less when there is no change of function. I don't see who would like to add further information if "current practice" is just to expose "php" and not any version number. I don't think it would reduce the number of attacks turning the version information off. But it would be more cumbersome to help people with php issues as the php version is not directly available. Honestly I'm not sure how I would feel on the "expose version number" issue if e.g. google would allow people to restrict their searches based on header information as well.
-- - Peter Brodersen

Derick Rethans

20 years ago
On Thu, 10 Nov 2005, Peter Brodersen wrote:
> Those targeting specific web sites might be able to figure out the > approximate version otherwise. The major version of php could be > determined in a couple of other ways, such as checking what animal > (sorry Thies :-) is present, e.g.: > http://www.php.net/cal.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42 > and otherwise still try any kind of exploit if the version information > is unavailable.
That special trick should be disabled when expose_php is set to off; did you verify that?
> I don't think it would reduce the number of attacks turning the > version information off. But it would be more cumbersome to help > people with php issues as the php version is not directly available.
Right, that was my point too. Derick
-- Derick Rethans http://derickrethans.nl | http://ez.no | http://xdebug.org

Wolfgang Drews

20 years ago
> > I don't think it would reduce the number of attacks turning the > > version information off. But it would be more cumbersome to help > > people with php issues as the php version is not directly available. > > Right, that was my point too.
yes, but in the end it is more a problem of user-perception. "hej, if security-experts say it is more secure, then ofcourse i will turn it off - after all i don't care for netcraft-stats" (and don't know about it either). finally, if people turn it off because of security-reasons, one should consider a compromise between "security" and "statistics" ... or not? best regards -Wolfgang
-- PHP-Centralpoint Dynamic Web Pages: http://www.dynamicwebpages.de/ German PHP-Certification: http://www.phpzertifizierung.de/

Ilia A.

20 years ago
The expose_php setting is an option, something each admin can make their own mind upon. Some will prefer not to waste bandwidth and tell the world what they are running, while others prefer to advertise PHP. Either approach is fine, but from security perspective you want to tell a potential attacker as little information as possible.
> I don't think it would reduce the number of attacks turning the > version information off. But it would be more cumbersome to help > people with php issues as the php version is not directly available.
This is simply not true, when a bug comes in we ask the user to specify the version, we don't go looking for their server and checking their version. Old versions of PHP have security holes, a directed attack against only the vulnerable servers would be much harder to spot and take far fewer resources to execute. Ilia

Peter Brodersen

20 years ago
On Thu, 10 Nov 2005 14:08:29 -0500, in php.internals ilia@prohost.org (Ilia Alshanetsky) wrote:
>> I don't think it would reduce the number of attacks turning the >> version information off. But it would be more cumbersome to help >> people with php issues as the php version is not directly available. >This is simply not true, when a bug comes in we ask the user to specify >the version, we don't go looking for their server and checking their >version.
I wasn't thinking of php development but more general when people have trouble with their PHP code (posting in newsgroups, forums, irc, ...). .. and from another post:
>Displaying this value does NOTHING, browser does not care if it is >there, neither does any proxy. So, why send it?
The information could help users helping each other. Furthermore the information could give a hint on the progress of migrating to newer versions of php for the rest of the world. I think this information could be pretty valuable for the php community, though I don't think this information has been used that much so far. Furthermore, this discussion has been taken for a bunch of different projects. Apache, mod_ssl, mod_perl and so on. I can't recall they seriously would encourage people to disable version information so much that they would change their default settings to reflect this. I would agree with Markus. This is security by obscurity. The automated attacks do happen anyway.
-- - Peter Brodersen

Jasper Bryant-Greene

20 years ago
Peter Brodersen wrote:
> On Thu, 10 Nov 2005 14:08:29 -0500, in php.internals ilia@prohost.org > (Ilia Alshanetsky) wrote: > >>>I don't think it would reduce the number of attacks turning the >>>version information off. But it would be more cumbersome to help >>>people with php issues as the php version is not directly available. >> >>This is simply not true, when a bug comes in we ask the user to specify >>the version, we don't go looking for their server and checking their >>version. > > I wasn't thinking of php development but more general when people have > trouble with their PHP code (posting in newsgroups, forums, irc, ...).
If someone asks me a PHP question on a newsgroup or forum, and I need to know their version, I ask them for it. If they don't know how, I tell them to run php -V This information would be completely useless in the newsgroup/forum use case because it's just as easy (if not easier) to ask them for it or get them to run PHP -V as it is to go hunt down their server and inspect the headers. Jasper

Wolfgang Drews

20 years ago
sorry list, this discussion is going into a totally wrong direction. To make my point clear once again:
>> it's all just a question of user-perception! <<
there is definitely NO NEED to discuss any security-items in this place - instead i wanted to make the right people think about changing the behavior of expose_php, while they are sitting together in paris and talk about the future of php. And this only, as maybe netcraft-numbers tell us, to at least take such a change into consideration. That's really all, so please stop discussing wether it may or may not be useful or more secure to activate expose_php or not. that is (in my eyes) REALLY not the question. if security experts have influence on people, that hence turn expose_php off and hence netcraft numbers for php go down, i can only say "Houston, we have a problem" and we should do something about it. thanks anyway for your input, i hope you understand my point of view, best regards -Wolfgang
-- PHP-Centralpoint Dynamic Web Pages: http://www.dynamicwebpages.de/ German PHP-Certification: http://www.phpzertifizierung.de/

Ilia A.

20 years ago
Jasper Bryant-Greene wrote:
> If someone asks me a PHP question on a newsgroup or forum, and I need to > know their version, I ask them for it. If they don't know how, I tell > them to run php -V
Too true, in most cases you'd actually want to see their phpinfo() page, since settings can often explain many behaviors or identify possible issues. Ilia

Markus Fischer

20 years ago
Wolfgang Drews wrote:
>>>I don't think it would reduce the number of attacks turning the >>>version information off. But it would be more cumbersome to help >>>people with php issues as the php version is not directly available. >> >>Right, that was my point too. > > > yes, but in the end it is more a problem of user-perception. "hej, if > security-experts say it is more secure, then ofcourse i will turn it > off - after all i don't care for netcraft-stats" (and don't know about > it either). > > finally, if people turn it off because of security-reasons, one should > consider a compromise between "security" and "statistics" ... or not?
I don't understand any of positions that it changes anything about security when turning it off. This is the number one "security by obscurity" example and is more worse than anything: it gives the users the wrong feeling they made a step in securing their vulnerable service. There are not many reasons why a check for a PHP version should be done. The probably most interesting one is the minor version when the attack can be carried to multiple versions with different offset for stack smashing or whatever the current best practice is. But as soon as the guys find out that people are turning it off (and I'm sure they found out already) they don't care about the version anyway and just go ahread and try brute force. All in all it's a complete false perception of security. - Markus

Ilia A.

20 years ago
Markus Fischer wrote:
> Wolfgang Drews wrote: > >>>> I don't think it would reduce the number of attacks turning the >>>> version information off. But it would be more cumbersome to help >>>> people with php issues as the php version is not directly available. >>> >>> >>> Right, that was my point too. >> >> >> >> yes, but in the end it is more a problem of user-perception. "hej, if >> security-experts say it is more secure, then ofcourse i will turn it >> off - after all i don't care for netcraft-stats" (and don't know about >> it either). >> finally, if people turn it off because of security-reasons, one should >> consider a compromise between "security" and "statistics" ... or not? > > > I don't understand any of positions that it changes anything about > security when turning it off. This is the number one "security by > obscurity" example and is more worse than anything: it gives the users > the wrong feeling they made a step in securing their vulnerable service.
Displaying this value does NOTHING, browser does not care if it is there, neither does any proxy. So, why send it? As far as security goes, if you want to provide a map to hackable servers that's up to you, I personally would rather avoid it.
> But as soon as the guys find out that people are turning it off (and I'm > sure they found out already) they don't care about the version anyway > and just go ahread and try brute force.
Sure, and that means by hitting more servers their attack gets noticed and blocked sooner. And it also gives further incentive for people to upgrade before they are "hit" because they'll know someone is actively going after their old version. Ilia

Andi Gutmans

20 years ago
I personally think it can hurt the PHP project to have expose_php turned off by default. A lot of PHP's push has been thanks to the Netcraft numbers. Andi At 10:56 AM 11/10/2005, Wolfgang Drews wrote:

Marcus Börger

20 years ago
Hello Andi, agreed, also we are doing very much work on security. Thus new and regular updated systems shouldn#t have a problem with exposing this. And we cannot do anything for unmaintained systems anyway. Therefore i think we or any user should not be ashamed or fear having php being exposed. best regards marcus Thursday, November 10, 2005, 11:47:22 PM, you wrote:

Jasper Bryant-Greene

20 years ago
Marcus Boerger wrote:
> agreed, also we are doing very much work on security. Thus new and regular > updated systems shouldn#t have a problem with exposing this. And we cannot > do anything for unmaintained systems anyway. Therefore i think we or any > user should not be ashamed or fear having php being exposed.
With the fast response time to security problems that has been characteristic of the PHP project, and the fact that these problems (and their subsequent fixes) are usually widely (though often incorrectly) reported by the media, it can be nothing more than a choice to stay on old versions. Therefore since they have chosen to stay on an older, possibly insecure, version, they also have the choice to turn expose_php off for themselves. Jasper

Wez Furlong

20 years ago
Turning off expose_php is just security by obscurity; a determined hacker can still probe for problems even if that setting is turned off. My vote is to leave it as-is; leave it to the administrator to decide if they want to turn it off. --Wez. On 11/10/05, Marcus Boerger <helly@php.net> wrote:

Jani Taskinen

20 years ago
Leave it alone. I vote we just drop this discussion. :) We have lot of more important things to talk about than about something like this.. --Jani On Thu, 10 Nov 2005, Wez Furlong wrote:
> > Turning off expose_php is just security by obscurity; a determined > hacker can still probe for problems even if that setting is turned > off. > > My vote is to leave it as-is; leave it to the administrator to decide > if they want to turn it off. > > --Wez. > > On 11/10/05, Marcus Boerger <helly@php.net> wrote: >> Hello Andi, >> >> agreed, also we are doing very much work on security. Thus new and regular >> updated systems shouldn#t have a problem with exposing this. And we cannot >> do anything for unmaintained systems anyway. Therefore i think we or any >> user should not be ashamed or fear having php being exposed. >> >> best regards >> marcus >> >> Thursday, November 10, 2005, 11:47:22 PM, you wrote: >> >>> I personally think it can hurt the PHP project to have expose_php >>> turned off by default. A lot of PHP's push has been thanks to the >>> Netcraft numbers. >> >>> Andi >> >>> At 10:56 AM 11/10/2005, Wolfgang Drews wrote: >>>>>> I don't think it would reduce the number of attacks turning the >>>>>> version information off. But it would be more cumbersome to help >>>>>> people with php issues as the php version is not directly available. >>>>> >>>>> Right, that was my point too. >>>> >>>> yes, but in the end it is more a problem of user-perception. "hej, if >>>> security-experts say it is more secure, then ofcourse i will turn it >>>> off - after all i don't care for netcraft-stats" (and don't know about >>>> it either). >>>> >>>> finally, if people turn it off because of security-reasons, one should >>>> consider a compromise between "security" and "statistics" ... or not? >>>> >>>> best regards >>>> >>>> -Wolfgang >> >> -- >> PHP Internals - PHP Runtime Development Mailing List >> To unsubscribe, visit: http://www.php.net/unsub.php >> >> > >
-- Give me your money at @ <http://pecl.php.net/wishlist.php/sniper> Donating money may make me happier and friendlier for a limited period! Death to all 4 letter abbreviations starting with P!

Ilia A.

20 years ago
Andi Gutmans wrote:
> I personally think it can hurt the PHP project to have expose_php turned > off by default. A lot of PHP's push has been thanks to the Netcraft > numbers.
I think a PHP worm would do far more harm, but then again I am not an marketing expert :-). IMHO the push behind PHP is due to big companies like Yahoo (who I should mention does not advertise their usage of PHP via headers) telling the world they put their trust in PHP. Also, word to mouth between various developers, users and ISP. Ilia