Red Hat Bugzilla – Bug 233776
Set expose_php in php.ini from On to Off
Last modified: 2007-11-30 17:12:00 EST
Description of problem: Set expose_php in php.ini from On to Off or is there any reason to show without any limitation that we've got the huge security hole called PHP installed? Version-Release number of selected component (if applicable): php-5.2.1-3 Expected results: Set expose_php in php.ini from On to Off
Thanks for the suggestion. This is the upstream default, I think that should be respected; as the saying goes, obscurity does not imply security, in any case.
Sorry, I can't agree with you. It's okay when it's upstream default, but we should act similar to OpenSSH at this downstream point. As the PHP version is normally never bumped, even if security holes are fixed, many many many pseudo security companies (!) complain, that PHP is not up-to-date (because of the PHP version) and vulnerable to abc and xyz, which isn't the case. And this applies especially to RHEL, where PHP versions are just old (but patched)... OpenSSH solved this problem by introducing a vendor string, maybe that's usefull for PHP, too. My personal easy solution would be, just to turn off the expose of PHP by downstream default.
Attempting to satisfy the remote-version-scanning tools is a futile task, and is not sufficient justification to deviate from the upstream default. The only way to reliably detect version/release/patchlevel is to do so locally. If you think it is correct to set expose_php to Off by default, then convince upstream first and the Fedora package will follow.