Home / server / Questions

Questions[php56](server)

Martin Hope
Philippe
Asked: 2020-11-19 08:28:04 +0800 CST
  • 0

First a note: Yes, I'm well aware this extension in deprecated and has a ton of security flaws, I'm duplicating a clients active server in docker for recovery and migration (after client's server was compromised).

Clients server is Centos6 based with php 5.6 and uses the original php mysql module (they just call it the original module) https://www.php.net/manual/en/book.mysql.php

I've tried a few of the original mysql repos (remi, webtatic) and they install PDO (the new mysql module).

I'm looking for a way to add the (insecure) original module to my docker container for working locally to recover assets and modernize the project, however it seems most of the repo's are using security best practices to remove the flawed software (or I'm not correctly understanding how to enable it).

I'm willing to build it myself if theres a repo of the original source, or if theres prebuilt somewhere I'm not aware of I'd be grateful.

centos mysql php security php56
Martin Hope
Amitabh Ghosh
Asked: 2017-02-16 04:00:01 +0800 CST
  • 0

Not sure if it is fit for ServerFault...

We have an e-commerce website, which we are planning to host on AWS. The CMS engine is Drupal7. I have plans to use 2 m4.xlarge (4 vCPU 16GiB) autoscaled across an ELB, hosted in eu-west-1 (Ireland). I am trying to achieve website speed and in process to fine-tune the apache. I have not edited the httpd.conf and it is as it was for httpd2.4. Though I have a Virtual Host.

<VirtualHost *:80>
        ServerName website.com
        ServerAlias www.website.com
        DocumentRoot /var/www/html/website
        DirectoryIndex index.php index.html

        <Directory /var/www/html/website>
                #Options Indexes FollowSymLinks MultiViews
                Options -Indexes
                AllowOverride All
                Order allow,deny
                Allow from all
        </Directory>
</VirtualHost>

<VirtualHost *:443>
        DocumentRoot /var/www/html/website
        DirectoryIndex index.php index.html
        ServerName website.com
        ServerAlias www.website.com
        SSLEngine On
        SSLCertificateFile /etc/ssl/certs/website.crt
        SSLCertificateKeyFile /etc/ssl/certs/website.key
        <Directory /var/www/html/website>
                #Options Indexes FollowSymLinks MultiViews
                Options -Indexes
                AllowOverride All
                Order allow,deny
                Allow from all
                Require all granted
        </Directory>
</VirtualHost>

Can anyone please suggest some mechanisms?

> Current Test Setup:
>     Amazon Linux t2.micro
>     Server version: Apache/2.4.25 (Amazon)
>     PHP 5.6.29 (cli) (built: Jan 18 2017 19:08:44)
>     Database: Amazon RDS MySQL 5.6.27 db.t2.micro (1 vCPU 1 GiB)
>     info.php reflects Server API as Apache 2.0 Handler


    [root@ip-10-1-39-3 kirana11]# httpd -V
    Server version: Apache/2.4.25 (Amazon)
    Server built:   Jan 19 2017 16:55:49
    Server's Module Magic Number: 20120211:67
    Server loaded:  APR 1.5.1, APR-UTIL 1.4.1
    Compiled using: APR 1.5.1, APR-UTIL 1.4.1
    Architecture:   64-bit
    Server MPM:     prefork
      threaded:     no
        forked:     yes (variable process count)
    Server compiled with....
     -D APR_HAS_SENDFILE
     -D APR_HAS_MMAP
     -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
     -D APR_USE_SYSVSEM_SERIALIZE
     -D APR_USE_PTHREAD_SERIALIZE
     -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
     -D APR_HAS_OTHER_CHILD
     -D AP_HAVE_RELIABLE_PIPED_LOGS
     -D DYNAMIC_MODULE_LIMIT=256
     -D HTTPD_ROOT="/etc/httpd"
     -D SUEXEC_BIN="/usr/sbin/suexec"
     -D DEFAULT_PIDLOG="/var/run/httpd/httpd.pid"
     -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
     -D DEFAULT_ERRORLOG="logs/error_log"
     -D AP_TYPES_CONFIG_FILE="conf/mime.types"
     -D SERVER_CONFIG_FILE="conf/httpd.conf"

When I run Google PageSpeed Insight, our scores are not very good Mobile Speed 40/100 Desktop Speed 50/100 How do i optimize this?

PS. I am aware that CDN would increase the scores and taking a more powerful instance+db.instance would also be useful

amazon-web-services apache-2.4 php56
Martin Hope
Anadi Misra
Asked: 2016-05-23 19:28:23 +0800 CST
  • 7

I have been searching on how to configure wordpress to connect to mysql db over ssl, however most of the example are about three to five years old e.g. this wordpress support topic

my wordpress version is 4.5.2 and obviusly the code and settings is nothing like what I in examples all over forums, is there a more relevant example on how to fix settings in wp-settings.php and wp-includes/wp-db.php to ensure secure connection to a remote MySql?

ssl wordpress php56 mysql5.5
Martin Hope
Anadi Misra
Asked: 2016-05-23 10:28:29 +0800 CST
  • 5

I get these error messages when logging in to phpmyadmin instance 

Error during session start; please check your PHP and/or webserver log file and configure your PHP installation properly. Also ensure that cookies are enabled in your browser.

mysqli_query(): SSL operation failed with code 1. OpenSSL Error messages: error:0607A082:digital envelope routines:EVP_CIPHER_CTX_set_key_length:invalid key length error:0607A082:digital envelope routines:EVP_CIPHER_CTX_set_key_length:invalid key length

mysqli_query(): MySQL server has gone away

mysqli_query(): Error reading result set's header

I have setup mysql certificated "self signed" on the hosts and from the maching running phpMyAdmin I can connect to remote MySql through the mysql client

expro_app@ubuntu-app:/etc/mysql$ mysql --ssl-ca=ca-cert.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem -h XX.XXX.X.103 -P 7306 -u admin_secure -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 45
Server version: 5.5.49-0ubuntu0.14.04.1 (Ubuntu)

Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> status;
--------------
mysql  Ver 14.14 Distrib 5.5.49, for debian-linux-gnu (x86_64) using readline 6.3

Connection id:      45
Current database:   
Current user:       admin_secure@ubuntu-app
SSL:            Cipher in use is DHE-RSA-AES256-SHA
Current pager:      stdout
Using outfile:      ''
Using delimiter:    ;
Server version:     5.5.49-0ubuntu0.14.04.1 (Ubuntu)
Protocol version:   10
Connection:     XX.XXX.X.103 via TCP/IP
Server characterset:    latin1
Db     characterset:    latin1
Client characterset:    utf8
Conn.  characterset:    utf8
TCP port:       7306
Uptime:         2 days 8 hours 7 min 31 sec

Threads: 1  Questions: 126  Slow queries: 0  Opens: 48  Flush tables: 1  Open tables: 41  Queries per second avg: 0.000

Here's the phpMyAdmin settings 

/* Authentication type */
$cfg['Servers'][$i]['auth_type'] = 'cookie';
/* Server parameters */
$cfg['Servers'][$i]['host'] = 'XX.XXX.X.103';
$cfg['Servers'][$i]['port'] = 'XXXX';
$cfg['Servers'][$i]['connect_type'] = 'tcp';
$cfg['Servers'][$i]['compress'] = false;
$cfg['Servers'][$i]['AllowNoPassword'] = false;
$cfg['Servers'][$i]['ssl']=true;
$cfg['Servers'][$i]['ssl_key'] = '/etc/mysql/client-key.pem';
$cfg['Servers'][$i]['ssl_cert'] = '/etc/mysql/client-cert.pem';
$cfg['Servers'][$i]['ssl_ca'] = '/etc/mysql/ca-cert.pem';
$cfg['Servers'][$i]['ssl_ciphers'] = 'DHE-RSA-AES256-SHA';
$cfg['Servers'][$i]['ssl_verify'] = false;

I am setting ssl_verify = false to avoid checking self-signed ceritifcates, given the little hack in libraries/dbi/DBIMysqli.php

if ($cfg['Server']['ssl']) {
            mysqli_ssl_set(
                $link,
                $cfg['Server']['ssl_key'],
                $cfg['Server']['ssl_cert'],
                $cfg['Server']['ssl_ca'],
                $cfg['Server']['ssl_ca_path'],
                $cfg['Server']['ssl_ciphers']
            );
            /*
             * disables SSL certificate validation on mysqlnd for MySQL 5.6 or later
             * @link https://bugs.php.net/bug.php?id=68344
             * @link https://github.com/phpmyadmin/phpmyadmin/pull/11838
             */
            if (! $cfg['Server']['ssl_verify']) {
                mysqli_options(
                    $link,
                    MYSQLI_OPT_SSL_VERIFY_SERVER_CERT,
                    $cfg['Server']['ssl_verify']
                );
                $client_flags |= MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT;
            }
        }

The error logs dont really help either, no OpenSSL messages there. On the remote server, nothing related to the phpMyAdmin machine's IP address on the MySql server machine either.

What am I missing here?

openssl phpmyadmin php56 mysql5.5