If you have root access to the server then move the config.php file out of you're root file system. if you're in /var/www/html/forum the put the actual config.php file into /var/www .
Then make a new config.php file and put in the code:
Code:
<?php require('/var/www/config.php'); ?>
You're FTP users should be jailed to the /var/www/html directory and thusly not able to chdir to www to read the contents of your config.php file.