1

I'm working on my CMS (in PHP platform) for a long time now. The main program is done and I'm currently developing the Installer part. Installation itself will be fairly simple:

  1. Upload all files
  2. Verify that the "content/" dir has correct permissions
  3. Check if ALL files are intact and not modified [This is the subject of this question]
  4. Insert the config data and first settings
  5. Run install (Generate all DB tables and insert sample data etc.)

Now the question-mark is at step 3. How do I verify ALL files? Verification itself should compare all CMS root-directories files against a list from remote location. List should contain filename, filesize and filetype. This way the user can check, that there are no unnecessary or corrupted files, that could indicated a breach in the software.

I have seen some software installers do that, but I cannot find any right now and there for I'm clueless on the most optimal method for this. Of course there always is a simple array trick, but there surely must be a better and faster method?!

Kalle H. Väravas
  • 793
  • 8
  • 17

2 Answers2

3

To check file integrity, generate and compare hashes of your files with the originals. For protecting against corrupted downloads, CRC-32 or MD5 would suffice. However if you want to ensure the files weren't altered by a malicious third-party, for whatever reason, look into SHA-1. All three are widely used and implemented and should be available for PHP.

Also, as K.Steff already noted, you can't prevent changes to be made to your software that way. Due to PHP being interpreted, files can easily be altered after installation.

scrwtp
  • 4,532
  • 1
  • 24
  • 29
1

First of all, I'd say checking for 'unnecessary' files is not really a good idea. The user might have installed your CMS in a common folder with another piece of software. On the other hand, if you confirm your own files are not corrupt, it should be OK, since a user has to edit your files in order to introduce something else in your CMS (otherwise your design is suboptimal, but it can happen if you import all files that fit a pattern; you shouldn't depend on this).

Another thing: in PHP (to my knowledge) you can't really make sure your files don't get edited to include a 'crack' to your security mechanism. This in turn means everything you do in the installer is theoretically useless, since it can be defeated by a smart enough adversary.

So, on the topic. If possible, use Public-key cryptography instead of hashing.
You can easily include a list of files and check them with sha1_file (hash) or a better equivalent (PKC). Then compare the computed values with the proper values and generate error messages if there are discrepancies.
If you really want to make sure only your files are on the server, use readdir to generate the list of files and check it against your bundle. This is all pretty straight-forward IMO.

K.Steff
  • 4,475
  • 2
  • 31
  • 28
  • The first part of your answer has a good point. Since I mostly use my CMS at the moment for my own clients, then I didn't think of the existing directory content. I also have a security system for cracking. Of course in PHP you cant have 100% secure software, but it mostly detects counterfake copies. The `sha_file()` was the lead I needed, thanks! – Kalle H. Väravas Jul 04 '12 at 01:29