Download
Stable releases of the source code can be found on the download page or on Github.
wget https://shadowd.zecure.org/files/shadowd_php-2.2.0.tar.gz
Installation
To install the connector you have to extract it and move the content to a location that is accessible by the web server, e.g., /usr/share/shadowd/php.
tar -xvf shadowd_php-2.2.0.tar.gz
sudo mkdir /usr/share/shadowd
sudo mv shadowd_php-2.2.0 /usr/share/shadowd/php
sudo chown -R root:root /usr/share/shadowd/php
PHP provides a setting with the name auto_prepend_file to automatically load additional PHP files every time the PHP binary is called. This can be used to load the connector on every request before the actual script is executed without having to change a single line of code.
Apache
If you are using Apache you can use php_value to set auto_prepend_file for specific vhosts or directories.
php_value auto_prepend_file "/usr/share/shadowd/php/shadowd.php"
Nginx
If you are using NGINX you can use fastcgi_param to set auto_prepend_file for specific vhosts or directories.
fastcgi_param PHP_ADMIN_VALUE "auto_prepend_file=/usr/share/shadowd/php/shadowd.php";
Global
If you want to enable Shadow Daemon globally you can set auto_prepend_file to /usr/share/shadowd/php/shadowd.php in your php.ini file (for example, /etc/php/7.2/cgi/php.ini
).
The change will take effect after you restart your web server, but you should wait with that until the configuration of the module is completely done.
This option is not recommended since the used configuration file depends on the PHP version, so updating PHP will result in an unloaded connector.
Configuration
Copy the configuration file from misc/examples/connectors.ini to /etc/shadowd/connectors.ini and edit it. The file is annotated and should be self-explanatory, but if you are stuck you can find more information in the documentation. Make sure that it is readable by the web server user, otherwise your site will not work anymore.
sudo mkdir /etc/shadowd
sudo cp /usr/share/shadowd/php/misc/examples/connectors.ini /etc/shadowd
sudo chown root:www-data /etc/shadowd/connectors.ini
sudo chmod 640 /etc/shadowd/connectors.ini
If you plan to protect multiple applications you can use the environment variable SHADOWD_CONNECTOR_CONFIG to specify different configuration files for every target.
Ignore sensitive input!
You should use the ignore function of the connector to disregard very sensitive input, e.g., passwords.
What’s next?
You have successfully installed Shadow Daemon, now you can start with the configuration. If you do not know how to configure Shadow Daemon check out the tutorial about rules.