Setup DNS Server and reverse DNS in CentOS 6.3

DNS (Domain Name System) is the core component of network infrastructure. The DNS service resolves hostname into ip address and vice versa. For example if we type http://www.google.com in browser, the DNS server translates the domain name into its corresponding ip address. So it makes us easy to remember the domain names instead of its ip address.

DNS Server Installation in CentOS 6.3

This how-to tutorial will shows you how to install and configure Primary and Scondary DNS server. The steps provided here are tested in CentOS 6.3 32 bit edition, but it should work in RHEL 6.x(x stands for version) and Scientific Linux 6.x too.

Scenario

Here are my test setup scenario

[A] Primary(Master) DNS Server Details:

Operating System     : CentOS 6.3 32 bit (Minimal Server)
Hostname             : masterdns.google.com
IP Address           : 192.168.1.200/24

[B] Secondary(Slave) DNS Server Details:

Operating System     : CentOS 6.3 32 bit (Minimal Server)
Hostname             : slavedns.google.com
IP Address           : 192.168.1.201/24  

Setup Primary(Master) DNS Server

[root@masterdns ~]# yum install bind* -y

1. Configure DNS Server

The main configuration of the DNS will look like below. Edit and add the entries below which are marked as bold in this configuration files.

[root@masterdns ~]# vi /etc/named.conf 
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
 listen-on port 53 { 127.0.0.1; 192.168.1.200;};                      ## Master DNS IP ##
 listen-on-v6 port 53 { ::1; };
 directory  "/var/named";
 dump-file  "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
 allow-query     { localhost; 192.168.1.0/24; };                      ## IP Range ##
 allow-transfer { localhost; 192.168.1.201; };                        ## Slave DNS IP ##  
 recursion yes;
 dnssec-enable yes;
 dnssec-validation yes;
 dnssec-lookaside auto;
 /* Path to ISC DLV key */
 bindkeys-file "/etc/named.iscdlv.key";
 managed-keys-directory "/var/named/dynamic";
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
zone "." IN {
 type hint;
 file "named.ca";
};
zone "google.com" IN {
 type master;
 file "fwd.google.com";
 allow-update { none; };
};
zone "1.168.192.in-addr.arpa" IN {
 type master;
 file "rev.google.com";
 allow-update { none; };
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

2. Create Zone files

Now we should create forward and reverse zone files which we mentioned in the ‘/etc/named.conf’ file.

[A] Create Forward Zone

Create ‘fwd.ostechnix.com’ file in the ‘/var/named’ directory and add the entries for forward zone as shown below.

[root@masterdns ~]# vi /var/named/fwd.google.com 
$TTL 86400
@   IN  SOA     masterdns.google.com. root.google.com. (
        2011071001  ;Serial
        3600        ;Refresh
        1800        ;Retry
        604800      ;Expire
        86400       ;Minimum TTL
)
@ IN  NS      masterdns.google.com.
@ IN  NS      slavedns.google.com.  masterdns     IN  A    192.168.1.200
slavedns      IN  A    192.168.1.201

[B] Create Reverse Zone

Create ‘rev.ostechnix.com’ file in the ‘/var/named’ directory and add the entries for reverse zone as shown below.

[root@masterdns ~]# vi /var/named/rev.google.com 
$TTL 86400
@   IN  SOA     masterdns.ostechnix.com. root.google.com. (
        2011071001  ;Serial
        3600        ;Refresh
        1800        ;Retry
        604800      ;Expire
        86400       ;Minimum TTL
)
@ IN  NS      masterdns.google.com.
@ IN  NS      slavedns.google.com.
masterdns IN  A   192.168.1.200
slavedns  IN  A   192.168.1.201
200       IN  PTR     masterdns.google.com.
201       IN  PTR     slavedns.google.com.

3. Start the bind service

[root@masterdns ~]# service named start
Generating /etc/rndc.key:                                  [  OK  ]
Starting named:                                            [  OK  ]
[root@masterdns ~]# chkconfig named on

4. Allow DNS Server through iptables

Add the lines shown in bold letters in ‘/etc/sysconfig/iptables’ file. This will allow all clients to access the DNS server.

[root@masterdns ~]# vi /etc/sysconfig/iptables
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p udp -m state --state NEW --dport 53 -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 53 -j ACCEPT-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

5. Restart iptables to save the changes

[root@masterdns ~]# service iptables restart
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules:                         [  OK  ]

6. Test syntax errors of DNS configuration and zone files

[A] Check DNS Config file

[root@masterdns ~]# named-checkconf /etc/named.conf 
[root@masterdns ~]# named-checkconf /etc/named.rfc1912.zones 

[B] Check zone files

[root@masterdns ~]# named-checkzone google.com /var/named/fwd.google.com 
zone ostechnix.com/IN: loaded serial 2011071001
OK
[root@masterdns ~]# named-checkzone google.com /var/named/rev.google.com 
zone ostechnix.com/IN: loaded serial 2011071001
OK
[root@masterdns ~]#

7. Test DNS Server

Method A:

[root@masterdns ~]# dig masterdns.google.com
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.6 <<>> masterdns.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11496
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
;; QUESTION SECTION:
;masterdns.google.com. IN A
;; ANSWER SECTION:
masterdns.google.com. 86400 IN A 192.168.1.200
;; AUTHORITY SECTION:
google.com.  86400 IN NS masterdns.google.com.
google.com.  86400 IN NS slavedns.google.com.
;; ADDITIONAL SECTION:
slavedns.google.com. 86400 IN A 192.168.1.201
;; Query time: 5 msec
;; SERVER: 192.168.1.200#53(192.168.1.200)
;; WHEN: Sun Mar  3 12:48:35 2013
;; MSG SIZE  rcvd: 110

Method B: 

[root@masterdns ~]# dig -x 192.168.1.200
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.6 <<>> -x 192.168.1.200
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40891
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;200.1.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
200.1.168.192.in-addr.arpa. 86400 IN PTR masterdns.google.com.
;; AUTHORITY SECTION:
1.168.192.in-addr.arpa. 86400 IN NS masterdns.google.com.
1.168.192.in-addr.arpa. 86400 IN NS slavedns.google.com.
;; ADDITIONAL SECTION:
masterdns.google.com. 86400 IN A 192.168.1.200
slavedns.google.com. 86400 IN A 192.168.1.201
;; Query time: 6 msec
;; SERVER: 192.168.1.200#53(192.168.1.200)
;; WHEN: Sun Mar  3 12:49:53 2013
;; MSG SIZE  rcvd: 150

Method C:

[root@masterdns ~]# nslookup masterdns
Server:  192.168.1.200
Address: 192.168.1.200#53
Name: masterdns.google.com
Address: 192.168.1.200

Thats it. Now the Primary DNS server is ready

Setup Secondary(Slave) DNS Server

[root@slavedns ~]# yum install bind* -y

1. Configure Slave DNS Server

Open the main configuration file ‘/etc/named.conf’ and add the lines as shown in bold letters.

[root@slavedns ~]# vi /etc/named.conf 
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
 listen-on port 53 { 127.0.0.1; 192.168.1.201; };                    ## Slve DNS IP ##      
 listen-on-v6 port 53 { ::1; };
 directory  "/var/named";
 dump-file  "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
 allow-query     { localhost; 192.168.1.0/24; };                     ## IP Range ##   
 recursion yes;
 dnssec-enable yes;
 dnssec-validation yes;
 dnssec-lookaside auto;
 /* Path to ISC DLV key */
 bindkeys-file "/etc/named.iscdlv.key";
 managed-keys-directory "/var/named/dynamic";
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
zone "." IN {
 type hint;
 file "named.ca";
};
zone "ostechnix.com" IN {
 type slave;
 file "slaves/google.fwd";
 masters { 192.168.1.200; };
};
zone "1.168.192.in-addr.arpa" IN {
 type slave;
 file "slaves/google.rev";
 masters { 192.168.1.200; };
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

2. Start the DNS Service

[root@slavedns ~]# service named start
Generating /etc/rndc.key:                                  [  OK  ]
Starting named:                                            [  OK  ]
[root@slavedns ~]# chkconfig named on

Now the forward and reverse zones are automatically replicated from Master DNS server to Slave DNS server. 

To verify, goto DNS database location(i.e ‘/var/named/slaves’) and use command ‘ls’.

[root@slavedns ~]# cd /var/named/slaves/
[root@slavedns slaves]# ls
ostechnix.fwd  google.rev

The forward and reverse zones are automatically replicated from Master DNS. Now check the zone files whether the correct zone files are replicated or not.

[A] Check Forward zone:

[root@slavedns slaves]# cat ostechnix.fwd 
$ORIGIN .
$TTL 86400 ; 1 day
ostechnix.com  IN SOA masterdns.google.com. root.google.com. (
    2011071001 ; serial
    3600       ; refresh (1 hour)
    1800       ; retry (30 minutes)
    604800     ; expire (1 week)
    86400      ; minimum (1 day)
    )
   NS masterdns.google.com.
   NS slavedns.google.com.
$ORIGIN ostechnix.com.
masterdns  A 192.168.1.200
slavedns   A 192.168.1.201

[B] Check Reverse zone:

[root@slavedns slaves]# cat ostechnix.rev 
$ORIGIN .
$TTL 86400 ; 1 day
1.168.192.in-addr.arpa IN SOA masterdns.google.com. root.google.com. (
    2011071001 ; serial
    3600       ; refresh (1 hour)
    1800       ; retry (30 minutes)
    604800     ; expire (1 week)
    86400      ; minimum (1 day)
    )
   NS masterdns.google.com.
   NS slavedns.google.com.
$ORIGIN 1.168.192.in-addr.arpa.
200   PTR masterdns.google.com.
201   PTR slavedns.google.com.
masterdns  A 192.168.1.200
slavedns   A 192.168.1.201

3. Add the DNS Server details to all systems

[root@slavedns ~]# vi /etc/resolv.conf 
# Generated by NetworkManager
search google.com
nameserver 192.168.1.200
nameserver 192.168.1.201
nameserver 8.8.8.8

4. Test DNS Server

Method A: 

[root@slavedns ~]# dig slavedns.google.com
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.6 <<>> slavedns.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39096
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
;; QUESTION SECTION:
;slavedns.google.com.  IN A
;; ANSWER SECTION:
slavedns.google.com. 86400 IN A 192.168.1.201
;; AUTHORITY SECTION:
google.com.  86400 IN NS masterdns.google.com.
google.com.  86400 IN NS slavedns.google.com.
;; ADDITIONAL SECTION:
masterdns.ostechnix.com. 86400 IN A 192.168.1.200
;; Query time: 7 msec
;; SERVER: 192.168.1.200#53(192.168.1.200)
;; WHEN: Sun Mar  3 13:00:17 2013
;; MSG SIZE  rcvd: 110

Method B:

[root@slavedns ~]# dig masterdns.google.com
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.6 <<>> masterdns.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12825
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
;; QUESTION SECTION:
;masterdns.google.com. IN A
;; ANSWER SECTION:
masterdns.google.com. 86400 IN A 192.168.1.200
;; AUTHORITY SECTION:
google.com.  86400 IN NS masterdns.google.com.
google.com.  86400 IN NS slavedns.google.com.
;; ADDITIONAL SECTION:
slavedns.ostechnix.com. 86400 IN A 192.168.1.201
;; Query time: 13 msec
;; SERVER: 192.168.1.200#53(192.168.1.200)
;; WHEN: Sun Mar  3 13:01:02 2013
;; MSG SIZE  rcvd: 110

Method C:

[root@slavedns ~]# nslookup slavedns
Server:  192.168.1.200
Address: 192.168.1.200#53
Name: slavedns.google.com
Address: 192.168.1.201

Method D:

[root@slavedns ~]# nslookup masterdns
Server:  192.168.1.200
Address: 192.168.1.200#53
Name: masterdns.google.com
Address: 192.168.1.200

Method E:

[root@slavedns ~]# dig -x 192.168.1.201
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.6 <<>> -x 192.168.1.201
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56991
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;201.1.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
201.1.168.192.in-addr.arpa. 86400 IN PTR slavedns.google.com.
;; AUTHORITY SECTION:
1.168.192.in-addr.arpa. 86400 IN NS masterdns.google.com.
1.168.192.in-addr.arpa. 86400 IN NS slavedns.google.com.
;; ADDITIONAL SECTION:
masterdns.google.com. 86400 IN A 192.168.1.200
slavedns.google.com. 86400 IN A 192.168.1.201
;; Query time: 6 msec
;; SERVER: 192.168.1.200#53(192.168.1.200)
;; WHEN: Sun Mar  3 13:03:39 2013
;; MSG SIZE  rcvd: 150

Method F:

[root@slavedns ~]# dig -x 192.168.1.200
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.6 <<>> -x 192.168.1.200
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42968
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;200.1.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
200.1.168.192.in-addr.arpa. 86400 IN PTR masterdns.google.com.
;; AUTHORITY SECTION:
1.168.192.in-addr.arpa. 86400 IN NS slavedns.google.com.
1.168.192.in-addr.arpa. 86400 IN NS masterdns.google.com.
;; ADDITIONAL SECTION:
masterdns.google.com. 86400 IN A 192.168.1.200
slavedns.google.com. 86400 IN A 192.168.1.201
;; Query time: 4 msec
;; SERVER: 192.168.1.200#53(192.168.1.200)
;; WHEN: Sun Mar  3 13:04:15 2013
;; MSG SIZE  rcvd: 150

Thats it. Both Primary and Secondary DNS Server is ready to use

Set up a CentOS 6 Postfix Email Server

The structure of the Email System

There are a number of components that make up a complete email system. Below is a brief description of each one:

Mail User Agent

This is the part of the system that the typical user is likely to be most familiar with. The Mail User Agent (MUA), or mail client, is the application that is used to write, send and read email messages. Anyone who has written and sent a message on any computer has used a Mail User Agent of one type or another.
Typical Graphical MUA’s on Linux are Evolution, Thunderbird and KMail. For those who prefer a text based mail client, there are also the more traditional pine and mail tools.

Mail Transfer Agent

The Mail Transfer Agent (MTA) is the part of the email system that does much of the work of transferring the email messages from one computer to another (either on the same local network or over the internet to a remote system). Once configured correctly, most users will not have any direct interaction with their chosen MTA unless they wish to re-configure it for any reason. There are many choices of MTA available for Linux including sendmail, Postfix, Fetchmail, Qmail and Exim.

Mail Delivery Agent

Another part of the infrastructure that is typically hidden from the user, the Mail Delivery Agent (MDA) sits in the background and performs filtering on the email messages between the Mail Transfer Agent and the mail client (MUA). The most popular form of MDA is a spam filter to remove all the unwanted email messages from the system before they reach the inbox of the user’s mail client (MUA). Popular MDAs are Spamassassin and Procmail. It is important to note that some Mail User Agent applications (such as Evolution, Thunderbird and KMail) include their own MDA filtering. Others, such as Pine and Basla, do not. This can be a source of confusion to the Linux beginner.

SMTP

SMTP is an acronym for Simple Mail Transport Protocol. This is the protocol used by the email systems to transfer mail messages from one server to another. This protocol is essentially the communications language that the MTAs use to talk to each other and transfer messages back and forth.

Configuring a CentOS 6 Email System

Many systems use the Sendmail MTA to transfer email messages and on many Linux distributions this is the default Mail Transfer Agent. Sendmail is, however, a complex system that can be difficult for beginner and experienced user alike to understand and configure. It is also falling from favor because it is considered to be slower at processing email messages than many of the more recent MTAs available.
Many system administrators are now using Postfix or Qmail to handle email. Both are faster and easier to configure than Sendmail.
For the purposes of this chapter, therefore, we will look at Postfix as an MTA because of its simplicity and popularity. If you would prefer to use Sendmail there are many books that specialize in the subject and that will do the subject much more justice than we can in this chapter.

Postfix Pre-Installation Steps

The first step before installing Postfix is to make sure that Sendmail is not already running on your system. You can check for this using the following command:

/sbin/service sendmail status

If sendmail is not installed, the tool will display a message similar to the following:

sendmail: unrecognized service

If sendmail is installed, but not running the following output will be displayed:

sendmail is stopped

If sendmail is running you will see the following:

sendmail (pid 2138) is running 

If sendmail is running on your system it is necessary to stop it before installing and configuring Postfix. To stop sendmail run the following command as super user:

/sbin/service sendmail stop

The next step is to ensure that sendmail does not get restarted automatically when the system is rebooted. The first step is to find out which run levels will automatically start sendmail. To do this we can use the chkconfig command-line tool as follows:

/sbin/chkconfig --list | grep sendmail

The above command will typically result in output similar to:

sendmail     0:off   1:off   2:on   3:on   4:on    5:on   6:off

This means that if the system boots into runlevels 2, 3, 4 or 5 then the sendmail service will automatically start. To turn off sendmail we can once again use the chkconfig command as follows:

/sbin/chkconfig sendmail off

The chkconfig tool defaults to changing the settings for runlevels 2, 3, 4 and 5. You can configure for specific runlevels using the –levels command line option if necessary.
To verify the settings run chkconfig one more time as follows:

/sbin/chkconfig --list | grep sendmail

And check that the output is as follows:

sendmail  0:off  1:off   2:off   3:off  4:off   5:off   6:off 

Sendmail is now switched off and configured so that it does not auto start when the system is booted. We can now move on to installing Postfix.

Installing Postfix on CentOS 6

By default, the CentOS 6 installation process installs Postfix for most configurations. To verify if Postfix is already installed, use the following rpm command in a Terminal window:

 
rpm -q postfix

If rpm reports that postfix is not installed, it may be installed as follows:

su -
yum install postfix

The yum tool will download and install postfix, and configure a special postfix user in the /etc/passwd file.

Configuring Postfix

The main configuration settings for Postfix are located in the /etc/postfix/main.cf file. There are many resources on the internet that provide detailed information on Postfix so this section will focus on the basic options required to get email up and running.
The key options in the main.cf file are:

myhostname = mta1.domain.com
mydomain = domain.com
myorigin = $myhostname
inet_interfaces = $myhostname

Other settings will have either been set up for you by the installation process or are not needed unless you are feeling adventurous and want to configure a more sophisticated email system.
The format of myhostname is host.domain.extension. For example if your Linux system is called MyLinuxHost and your internet domain is MyDomain.com you would set the myhostname option as:

myhostname = mylinuxhost.mydomain.com
The mydomain setting is just the domain part of the above setting. For example: 
mydomain = mydomain.com

The myorigin and inet_interfaces options use the settings we have just created so do not need to be changed (although the inet_interfaces may be commented out by default so you should remove the # at the beginning of this particular line in the main.cf file).

Starting Postfix on a CentOS 6 System

Once the /etc/postfix/main.cf file is configured with the correct settings it is now time to start up postfix. This can be achieved from the command line as follows:

/usr/sbin/postfix start

The postfix process should now start up. The best way to check that everything is working is to check your mail log. This is typically in /var/log/maillog and should now contain an entry that looks like:

Nov 21 13:05:46 mylinuxhost postfix/postfix-script: starting the Postfix mail system Nov 21 13:05:46 mylinuxhost postfix/master[10334]: daemon started -- version 2.2.5, 
configuration /etc/postfix 

As long as you don't see any error messages you have successfully installed and started Postfix and you are ready to set up a mail client and start communicating with the outside world.
To configure Postfix to start automatically at system startup, run the following command in a Terminal window:

/sbin/chkconfig --level 345 postfix on

CentOS / RHEL 6: Install Suhosin PHP Advanced Protection System

Suhosin is an open source patch for PHP. How do I install suhosin under CentOS / Red Hat Enterprise Linux server running on my IBM server?

Tutorial details
Difficulty	Intermediate (rss)
Root privileges	Yes
Requirements	EPEL repo
Estimated completion time	N/A

Suhosin patch is an advanced protection system for PHP installations. It was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core.

Installation

First, turn on EPEL repo and type the following yum command to install the same:
# yum install php-suhosin
Sample outputs:

Loaded plugins: product-id, protectbase, rhnplugin
0 packages excluded due to repository protections
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package php-suhosin.x86_64 0:0.9.29-2.el6 will be installed
--> Finished Dependency Resolution
 
Dependencies Resolved
 
===============================================================================
 Package             Arch           Version                 Repository    Size
===============================================================================
Installing:
 php-suhosin         x86_64         0.9.29-2.el6            epel          73 k
 
Transaction Summary
===============================================================================
Install       1 Package(s)
 
Total download size: 73 k
Installed size: 187 k
Is this ok [y/N]: y
Downloading Packages:
php-suhosin-0.9.29-2.el6.x86_64.rpm                     |  73 kB     00:00
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Warning: RPMDB altered outside of yum.
  Installing : php-suhosin-0.9.29-2.el6.x86_64                             1/1
Installed products updated.
  Verifying  : php-suhosin-0.9.29-2.el6.x86_64                             1/1
 
Installed:
  php-suhosin.x86_64 0:0.9.29-2.el6
 
Complete!
 

Configuration

You need to edit /etc/php.d/suhosin.ini, enter:
# vi /etc/php.d/suhosin.ini
For most users the Suhosin will work out of the box without any change to the default configuration needed. However, you may need to make changes as per your setup. See this page for more information.

Restart the web server

Type the following command to restart Apache 2:
# service httpd restart
Lighttpd user type the following command:
# service lighttpd restart
Nginx user type the following command:
# service nginx restart

Test your setup

Type the following command
$ php -v
Sample outputs:

PHP 5.3.3 (cli) (built: Jun 25 2012 04:41:23)
Copyright (c) 1997-2010 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies
    with Suhosin v0.9.32.1, Copyright (c) 2007-2010, by SektionEins GmbH

You can also use phpinfo():

 
<?php
phpinfo();
?>
 

Sample output: