1. 1) Installation
2. 2) Reacting to the attack:
3. 3) Enabling / Disabling
4. 4) Next version 0.3
5. 5) How to upgrade?

PHPIDS is known project that can be seen in php-ids.org.

PHPIDS is an intrusion detection system, essentially based on IDS rules recognizes attacks by filtering information sent to the system and returns a rating and a report of what is considered a potential attack. From this information the system can react to the attack, send e-mail alerts, generate detailed logs, block the user, generate black list, etc..

The project PHPIDS was encapsulated in the form of the application component Yii and can be downloaded at http://www.yiiframework.com/extension/phpids/ next to your instructions installation and use.

This how-to shows, and since its installation in more detail some uses.

This component was tested on versions 1.1.5 and 1.1.4 with PHP 5.2. The current version of the component is 0.2 in the inscription of how-to.

1) Installation ¶

Download the latest version of the component in PHPIDS [http://www.yiiframework.com/extension/phpids/](http://www.yiiframework.com/extension/phpids/ "http://www.yiiframework.com/extension/phpids/)

Unzip the file ... .webapp / protected / components / ids

Make the directory ... / components / ids / IDS / tmp writable

Update on ... main.php his / protected / config

... 
/ / 'Preload' => array ('log') 
'Preload' => array ('log', 'ids'), 
... 
components = array ( 
... 
        'ids' => array ( 
            'class' => 'application.components.ids.CPhpIds' 
        ) 
) 

Add the component ids to preload the application. In components add the component input ids and their settings. The file above is the minimum for the operation of ids.

All application forms will be filtered by the PHPIDS, the variables $ _REQUEST, $ _GET, $ _POST and $ _COOKIE are verified by types attacks reported in the IDS rules detecação. If an attack potential is detected before the application is stopped processing of the request, an exception is thrown with a message generic error with no details to the attacker and a detailed log is generated.

This log is generated by the application component Log Yii, so a attack can be sent by e-mail (EmailLog), or stored in a database, file or simply displayed in the browser with the WebLog.

We can develop this further configuration, a message is simple details sent to the attacker:

... 
'ids' => array ( 
            'Class' => 'application.components.ids.CPhpIds' 
'genericMessage' => 'Unexpected error!' 
/ / Message sent to the attacker 
        ) 
... 

The goal is that this message has not details about the attack, nor inform the attacker that his attack was detected. And because the treatment is given internally by the application, sending emails or Alert simply blocking the user.

This message does not enter the log, the details of the attack are generated and sent to the logging component.

2) Reacting to the attack: ¶

... 
'Ids' => array ( 
            'Class' => 'application.components.ids.CPhpIds' 
'GenericMessage' => 'Unexpected error!' 
/ / Message sent to the attacker 
'Callback' => create_function (''," echo 'Error!'; 
Yii:: app () -> end (); return false; ") 
        ) 
... 

The callback parameter receives a valid callback as parameter, see call_user_func function in the PHP Manual. It may be a function, or a class and the method that should be called. In the above example we create a simple function prints error, terminates the application.

Through this configuration, the developer can handle in the best detected attacks, sending emails, alerts, creating a black list, removing user access, ending the session, etc.. After processing of the callback exception default component will not released, ending the request is the responsibility of developer using the function / method passed as callback.

3) Enabling / Disabling ¶

... 
'Ids' => array ( 
            'Class' => 'application.components.ids.CPhpIds' 
'GenericMessage' => 'Unexpected error!' 
/ / Message sent to the attacker 
'Callback' => create_function (''," echo 'Error!'; 
Yii:: app () -> end (); return false; ") 
'Enable' => ('',' create_function return $ _GET ["r"]! = 
Site / contact ";'), 
        ) 
... 

The enable parameter is used to enable or disable the execution of PHPIDS. This parameter can directly receive a boolean value, true IDS to run the check or false not to run. Or you can receive a valid callback that should return a boolean value. With this IDS configuration can be activated in only a few requests based on the rules of valid callback passed as parameter. See call_user_func function to learn more about callbacks valid.

4) Next version 0.3 ¶

• For next release, more configuration possibilities of PHPIDS, Log internal as IDS, tmp folder and others.

• Having your major change in processing the callback, which received as a parameter to assess the impact of the attack, so the developer can decide how to react based on the knowledge level of the attacker.

5) How to upgrade? ¶

Download the updated file default_rules.xml http://php- ids.org / and replace the version old in the ... / public / components / ids / IDS

Credits and thanks the team of developers PHPIDS. -------------------------------------------------- --------------