Move and or Rename config.php

What does this do?
This mod allows you to move your config.php file for added security.

Version Compatibility
3.5.4+, 3.6.0 Gold+


4/18/2006 - 1.0.1 update
fixes for file changes in the newest version of diagnostic.php, no other changes

I take no credit for this mod by Zachery and have ported it with permission.
vb 3.0.x version here

file edits:2

Originally Posted by Zachery

Downsides?

At the moment, during the install / upgrade sequence you will need to move config.php back.

[akanevsky]

How exactly does this contribute to security? If your server is correctly configured then noone would have access to the file anyway.

[Protoman]

exactly. and when they decide to upgrade your server and php wont start for some BS reason it just spits out the source code of any files, which has happened to me before.

[akanevsky]

Well, in that case, it would still be possible to identify where config.php is located, just by looking at the source. The only solution is to change the host.

[raramomo]

hello thank you very much I just try it but there are some errors

In 'includes/class_core.php'
======
 Find
======
include(CWD . '/includes/config.php');

==============
 Replace With
==============

include(CWD . '/PATH/TO/YOUR/config.php');


======
 Find
======

if (file_exists(CWD. '/includes/config.php'))

==============
 Replace With
==============

if (file_exists(CWD . '/PATH/TO/YOUR/config.php'))

[Protoman]

CWD would only be useful if you are renaming the config.php and not moving it. otherwise CWD would cause errors because you're calling the file from outside the current directory.

you can add the CWD if you want to keep the /file/path shorter, but if outside of /includes/ it will cause problems.

[greyhat]

Personally I consider the config.php to be vbulletin's biggest security problem. If the file can be read (and I believe it requires the httpd to have read and execute, please correct me if I'm wrong).As if you know the user/pass for MySQL an attacker can connect to the database and get up to all sorts of mischief.

I'd like to encrypt (not just encode) config.php but any product that'll do this costs a few hundred $$ if not more.

If config.php is renamed and put in a dir with only execute on it, it'll stop anyone finding it easily if PHP safe mode is on as well.

If the file can be read by an attacker they can connect to the database then create themselves an admin user or alter an admin user's password hash in MySQL.

Works great in 3.6.2

[Gbml2u]

i have a question

what is " /PATH/TO/YOUR/CONFIGDIR " ?
I mean full path (home/user/configdir - outsite public HTML ) or short path (/configdir - inside publicHTML )

[Protoman]

you want the full path outside the web root
so /home/user/configdir/

[Quarterbore]

Originally Posted by greyhat

Personally I consider the config.php to be vbulletin's biggest security problem. If the file can be read (and I believe it requires the httpd to have read and execute, please correct me if I'm wrong).As if you know the user/pass for MySQL an attacker can connect to the database and get up to all sorts of mischief.

I'd like to encrypt (not just encode) config.php but any product that'll do this costs a few hundred $$ if not more.

If config.php is renamed and put in a dir with only execute on it, it'll stop anyone finding it easily if PHP safe mode is on as well.

If the file can be read by an attacker they can connect to the database then create themselves an admin user or alter an admin user's password hash in MySQL.

Works great in 3.6.2

I have been studing hacker's tools and there are a number of them that are purpost built fo get a config file and try to find the password and username. Then, I have seen scripts go one step further and try using the Usename and Password to access cpanel!

Anybody with a cpanel username or password that can be figured out by your database connections would be very wise to evaluate that cpanel password based on what I have seen.

The problem is these hackers just need to find one file that lets them upload a script and then they can get access to your config files and from there they get your database. If they can get FTP or CPANEL access too, well damn your are going to get hurt!

Hiding config files looks like a good idea to me the more I try to study the tools hackers use.

I am working on a project to look for fulnerable situations as well as scan for potential hacker scripts that could be on your server. I have quite a bit more to do but I found this thread looking for things I need to include in the script. In essense, I have a server side spider that can be installed in any directory including those by .htaccess permissions and the goal is to identify hacker tools when they are installed as well as potentially identify scripts that hackers might get if they managed to get a file on your server.

Oh well, I am tagging this as I want to change my config locations.

[Say3]

i have changed my config.php dir , after that the home page ( VBadvanced ) get white blank ?

VbSeo Not Working , i have fix VbSeo but don't know how to fix VbAdvanced ? can you help plz ?