i talked to the hacker.... can someone help

[Angel-Wings]

Originally Posted by Lizard King

No it will prevent them to read if you correctly chmod and chown the file so nobody expect root access can read the file. Example , lets say we move config.php to /etc/vb the following will prevent anyone expect root access to read the file.

# chown -R apache:root /etc/vb
# chmod 0640 /etc/vbulletin/config.php

I believe Floren had an article about this within article section , yep here it is :
https://vborg.vbsupport.ru/showthread.php?t=148209

Do you read this manual - specially the part about "chown" ?

chown lighttpd config.php

Means nothing else than that the user PHP or the Webserver is running under can read this file. Since this is the case, it's useless to move that file anywhere and then softlink it back in the webroot.
Doing a:

chown root:root config.php

With the 0600 permission would leave the file unreadable to everyone except "root" but this also means you have to run your PHP / Webserver with "root" rights in order that this file can be read by Vbulletin or you'll see the "Database Error" page.

Also - when not creating symlinks that point in your webroot you can configure your Webserver in a way to ignore any symlinked files which might give a performance plus.

The way with moving the file, then symlinking it back has no advantage, a simple "cat config.php" will still work.

Back to the problem - move away from this hoster. If it's possible that another customer can upload a PHP shell - by accident or not - and then someone can browse all sites including the ones of other customers as well there's a huge security problem.

If that is possible - trying to secure your VB installation will never be successful