vb.org Archive - HOWTO: Secure your vBulletin sensitive data

vBulletin is a very secure web application. Except the fact that it has the database, user name and password included into a readable text file.
There is a very simple way to correct this issue.
Basically, you grab the sensitive information and you move it outside the public area.

Secured vBulletin config.php file
Let's presume your server has the following structure:

Code:

/root

--/etc

--/usr

----/etc

--/var

----/www

------/html

--------/forum

----------/includes

Start by opening your config.php file:

Code:

[root@Linux-PC ~]# gedit /var/www/html/forum/includes/config.php

Paste inside the PHP EOF key (?>). It probably got deleted by accident in one of the SVN branches. It should look like that:

Code:

/*======================================================================*\

|| ####################################################################

|| # Downloaded: 17:35, Wed May 16th 2007

|| # CVS: $RCSfile$ - $Revision: 16258 $

|| ####################################################################

\*======================================================================*/

?>

Now, run those commands:

Code:

[root@Linux-PC ~]# mkdir /etc/vbulletin

[root@Linux-PC ~]# mv /var/www/html/forum/includes/config.php /etc/vbulletin/config.php

[root@Linux-PC ~]# ln -s /etc/vbulletin/config.php /var/www/html/forum/includes/config.php

[root@Linux-PC ~]# chown -R lighttpd:root /etc/vbulletin

[root@Linux-PC ~]# chmod 0640 /etc/vbulletin/config.php

I really hope you use nginx or lighttpd as web server, not Crapache, the resources hogger who eats memory like an elephant. Large sites like YouTube, Sourceforge, Alexa, etc. use it, you should also.

Secured MySQL vBulletin user
Start by creating a new database user:

Code:

[root@Linux-PC ~]# mysql -u root -p

Enter password: n50Ig7vYzXy2sXfc

Welcome to the MySQL monitor.  Commands end with ; or \g.

Your MySQL connection id is 43 to server version: 5.0.22



Type 'help;' or '\h' for help. Type '\c' to clear the buffer.



mysql> GRANT ALTER, CREATE, DELETE, DROP, INDEX, INSERT, LOCK TABLES, UPDATE, SELECT

        ON vbdatabase.*

        TO 'vbuser'@'localhost'

        IDENTIFIED BY 'Ov4d4wk1BVXDllh9';

mysql> FLUSH PRIVILEGES;

mysql> SELECT Host, User FROM mysql.user;

+-----------+--------+

| Host      | User   |

+-----------+--------+

| localhost | root   |

| localhost | vbuser |

+-----------+--------+

mysql> quit

Note: Did you know that you can paste a password into your telnet window?
No need to memorize them... so you can use very complex passwords in your Linux configuration. :)

The privileges listed above are the only ones vBulletin needs for any operation, including upgrades.
Make sure you have only the users you need/use, in your MySQL database.
Hosts or users defined as "" are dangerous because they open the door to security issues.
The MySQL site tells you how to secure your user accounts, very well.

Also, I strongly suggest you to use at least 85 bits, for the quality of your server passwords.
A very good tool to generate and have all your passwords grouped together is KeePass.
It will store very securely all your important passwords. The beauty of this program is the fact that you can keep it on your USB flash drive and travel with it everywhere. Plus, it is free and works on Windows, Linux and MacOS.
I use it all the time to generate very strong passwords for all my server configurations.

Shared Accounts
If you are on a shared account, get a server. vBulletin was not meant to run on a shared account. Once your forums are getting a little popular, the site will die on you constantly.

That's all, enjoy your secured config.php file as well the secured MySQL user. :)

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01127 seconds Memory Usage 1,728KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (5)bbcode_code_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (7)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: