Move and or Rename config.php

[Protoman]

What does this do?
This mod allows you to move your config.php file for added security.

Version Compatibility
3.5.4+, 3.6.0 Gold+


4/18/2006 - 1.0.1 update
fixes for file changes in the newest version of diagnostic.php, no other changes

I take no credit for this mod by Zachery and have ported it with permission.
vb 3.0.x version here (https://vborg.vbsupport.ru/showthread.php?s=&threadid=79185)

file edits:2


Downsides?

At the moment, during the install / upgrade sequence you will need to move config.php back.

[Cole2026]

I don't know why you would want to do this, as long as you have the config file's permissions decently set, there is no need for this. I mean, I would do this if I could without file edits, but doing all those edits is not worth my while.

:\

[o1dirtydog]

i think this is a great idea... anything to stump someone trying to hack your web site.

thanx

[Marco van Herwaarden]

If your webserver is setup correct, nobody can download (or alter) and .php file. So i also don't really see the use of this.

[dead7]

Well for those who might not know if its setup correctly, or even shared hosts, this seems like a fairly sane thing to add a bit more assurance.... Fair enough everyone? ;)

[Watson]

dont blame proto, blame Zach, he made it 1st :p

[Hoojie]

So . . . for those people who think this is overkill . . . why don't you list the steps a novice Unix/Linux board owner should take to ensure that the config.php (containing the DB name, DB user name, Password) cannot be ripped by a hacker?

Or point to a post that details the nuts and bolts.

As for me, I keep all my sensitive stuff behind the scenes as a matter of course.
Most tools, like automated backup scripts for example, enable you to reference your settings away from the publicy accessible areas.

Who the heck knows when some warped genius will publish/sell techniques that invalidate access settings that we currently set up via chmod.

[futuredood]

this only takes 2 file edits.. shall do

[almqdad]

Hello

what happens during upgrade do I have to move back config.php

thanks

[Protoman]

yes, you need to move back the config.php to includes. then after you've upgraded, completed the file edit, you can move it back to wherever

[akanevsky]

How exactly does this contribute to security? If your server is correctly configured then noone would have access to the file anyway.

[Protoman]

exactly. and when they decide to upgrade your server and php wont start for some BS reason it just spits out the source code of any files, which has happened to me before.

[akanevsky]

Well, in that case, it would still be possible to identify where config.php is located, just by looking at the source. The only solution is to change the host.

[raramomo]

hello thank you very much I just try it but there are some errors


In 'includes/class_core.php'
======
Find
======
include(CWD . '/includes/config.php');

==============
Replace With
==============

include(CWD . '/PATH/TO/YOUR/config.php');


======
Find
======

if (file_exists(CWD. '/includes/config.php'))

==============
Replace With
==============

if (file_exists(CWD . '/PATH/TO/YOUR/config.php'))

[Protoman]

CWD would only be useful if you are renaming the config.php and not moving it. otherwise CWD would cause errors because you're calling the file from outside the current directory.

you can add the CWD if you want to keep the /file/path shorter, but if outside of /includes/ it will cause problems.

[greyhat]

Personally I consider the config.php to be vbulletin's biggest security problem. If the file can be read (and I believe it requires the httpd to have read and execute, please correct me if I'm wrong).As if you know the user/pass for MySQL an attacker can connect to the database and get up to all sorts of mischief.

I'd like to encrypt (not just encode) config.php but any product that'll do this costs a few hundred $$ if not more.

If config.php is renamed and put in a dir with only execute on it, it'll stop anyone finding it easily if PHP safe mode is on as well.

If the file can be read by an attacker they can connect to the database then create themselves an admin user or alter an admin user's password hash in MySQL.

Works great in 3.6.2

[Gbml2u]

i have a question

what is " /PATH/TO/YOUR/CONFIGDIR " ?
I mean full path (home/user/configdir - outsite public HTML ) or short path (/configdir - inside publicHTML )

[Protoman]

you want the full path outside the web root
so /home/user/configdir/

[Quarterbore]

Personally I consider the config.php to be vbulletin's biggest security problem. If the file can be read (and I believe it requires the httpd to have read and execute, please correct me if I'm wrong).As if you know the user/pass for MySQL an attacker can connect to the database and get up to all sorts of mischief.

I'd like to encrypt (not just encode) config.php but any product that'll do this costs a few hundred $$ if not more.

If config.php is renamed and put in a dir with only execute on it, it'll stop anyone finding it easily if PHP safe mode is on as well.

If the file can be read by an attacker they can connect to the database then create themselves an admin user or alter an admin user's password hash in MySQL.

Works great in 3.6.2

I have been studing hacker's tools and there are a number of them that are purpost built fo get a config file and try to find the password and username. Then, I have seen scripts go one step further and try using the Usename and Password to access cpanel!

Anybody with a cpanel username or password that can be figured out by your database connections would be very wise to evaluate that cpanel password based on what I have seen.

The problem is these hackers just need to find one file that lets them upload a script and then they can get access to your config files and from there they get your database. If they can get FTP or CPANEL access too, well damn your are going to get hurt!

Hiding config files looks like a good idea to me the more I try to study the tools hackers use.

I am working on a project to look for fulnerable situations as well as scan for potential hacker scripts that could be on your server. I have quite a bit more to do but I found this thread looking for things I need to include in the script. In essense, I have a server side spider that can be installed in any directory including those by .htaccess permissions and the goal is to identify hacker tools when they are installed as well as potentially identify scripts that hackers might get if they managed to get a file on your server.

Oh well, I am tagging this as I want to change my config locations.

[Say3]

i have changed my config.php dir , after that the home page ( VBadvanced ) get white blank ?

VbSeo Not Working , i have fix VbSeo but don't know how to fix VbAdvanced ? can you help plz ?