RE: Release with php 7 compatibility
06-03-2017, 11:38 AM
(This post was last modified: 06-03-2017, 11:41 AM by Eulogy.)
Effectively, we don't have a lot of choice as open source web firewall. I'm working for a Canadian hosting company, and we use Mod_security as web firewall layer like 80% of current web hosting.
The avantage of Suhosin on Mod_security, it's because Suhosin do almost a great job without any painful setting and optimization. All you need to do, it's disable some functions and Suhosin does what remain. or almost. The problem with Suhosin, it's because the main developer looks to don't continu the project. At least we have low support and update. It's the reason why I'm working on a project base with Mod_security, fail2ban and the OWASP ModSecurity Core Rule Set. A scalables core rule set with possibility of cron update. All compatible with Fast-cgi, apache and php 7.x . I'm on right optimization and customisation for the Mod_sec rules for Sentora. I'm working on php 7.0.19 without Suhosin.
This is what we need for involve the security of Sentora on the next version :
- Taking off zsudo from the code architecture;
- Put all bases passwords encrypted in the mysql Database;
- Change Suhosin for a customized Mod_security for evolution and compatibility;
- Change the input for ssl.conf for the vhost;
- incorporate a module with Let's Encrypt for give the possibility to the users to install a Free SSL through the interface.
With these ameliorations, I think Sentora can gain in popularity. Because one of the biggest critic about Sentora, his about his security leak.
Eulogy.
The avantage of Suhosin on Mod_security, it's because Suhosin do almost a great job without any painful setting and optimization. All you need to do, it's disable some functions and Suhosin does what remain. or almost. The problem with Suhosin, it's because the main developer looks to don't continu the project. At least we have low support and update. It's the reason why I'm working on a project base with Mod_security, fail2ban and the OWASP ModSecurity Core Rule Set. A scalables core rule set with possibility of cron update. All compatible with Fast-cgi, apache and php 7.x . I'm on right optimization and customisation for the Mod_sec rules for Sentora. I'm working on php 7.0.19 without Suhosin.
This is what we need for involve the security of Sentora on the next version :
- Taking off zsudo from the code architecture;
- Put all bases passwords encrypted in the mysql Database;
- Change Suhosin for a customized Mod_security for evolution and compatibility;
- Change the input for ssl.conf for the vhost;
- incorporate a module with Let's Encrypt for give the possibility to the users to install a Free SSL through the interface.
With these ameliorations, I think Sentora can gain in popularity. Because one of the biggest critic about Sentora, his about his security leak.
Eulogy.
