i talked to the hacker.... can someone help

actually, this whole topic have no place on this site... the ONLY thing you can do is TALK TO YOUR HOST SUPPORT STAFF... isn't it that easy to understand ???

[Lizard King]

Originally Posted by Marco van Herwaarden

that would still ot prevent anyone with server access (!!!) to read the config file. The only solution in this case is to have your host increase security or switch hosts.

No it will prevent them to read if you correctly chmod and chown the file so nobody expect root access can read the file. Example , lets say we move config.php to /etc/vb the following will prevent anyone expect root access to read the file.

# chown -R apache:root /etc/vb
# chmod 0640 /etc/vbulletin/config.php

I believe Floren had an article about this within article section , yep here it is :
https://vborg.vbsupport.ru/showthread.php?t=148209

[Marco van Herwaarden]

The webserver process will always need read access to the config file. This will ost likely mean you can not set permissions in such a way that others will not have read access.

[Angel-Wings]

Originally Posted by Lizard King

No it will prevent them to read if you correctly chmod and chown the file so nobody expect root access can read the file. Example , lets say we move config.php to /etc/vb the following will prevent anyone expect root access to read the file.

# chown -R apache:root /etc/vb
# chmod 0640 /etc/vbulletin/config.php

I believe Floren had an article about this within article section , yep here it is :
https://vborg.vbsupport.ru/showthread.php?t=148209

Do you read this manual - specially the part about "chown" ?

chown lighttpd config.php

Means nothing else than that the user PHP or the Webserver is running under can read this file. Since this is the case, it's useless to move that file anywhere and then softlink it back in the webroot.
Doing a:

chown root:root config.php

With the 0600 permission would leave the file unreadable to everyone except "root" but this also means you have to run your PHP / Webserver with "root" rights in order that this file can be read by Vbulletin or you'll see the "Database Error" page.

Also - when not creating symlinks that point in your webroot you can configure your Webserver in a way to ignore any symlinked files which might give a performance plus.

The way with moving the file, then symlinking it back has no advantage, a simple "cat config.php" will still work.

Back to the problem - move away from this hoster. If it's possible that another customer can upload a PHP shell - by accident or not - and then someone can browse all sites including the ones of other customers as well there's a huge security problem.

If that is possible - trying to secure your VB installation will never be successful