Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My understanding is that you should never host your configuration.php file within the public_html directory (I am specifically referring to Joomla, but I imagine this is a cross-platform scenario).

My question is: is it at all possible for a user to access/view this configuration file over the internet, or would they first have to exploit the server and then use that exploit to access the config file. In other words, is the best-practice of keeping configuration.php outside of the web root purely to stop a minor exploit from escalating higher, or does the file's existence provide a vulnerability in and of itself?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

A configuration file is not publicly viewable over the internet as long as the permissions are setup correctly. Configuration files usually do not output any data directly anyway.

They are able to download a copy of the configuration file if they exploit your server and gain access via methods such as SSH, FTP or through a web-based control panel.

Keeping the configuration.php file outside of the web root directory does increase the level of security, however if an attacker was to compromise your server and gain full access then they are still able to access this file.

share|improve this answer
1  
It's not really a permissions issue - unless you run your CGI / fastCGI under a differnt uid than the webserver - the issue arises when the webserver fails to filter php files through the PHP engine, either via direct access or LFI. Keeping configuration files / authentication tokens outside the document is good practice but it's not a panacea. –  symcbean Oct 2 '12 at 10:54

With a normal web server configuration (at least in most web hosting companies), any PHP files cannot be access directly by visitors over the Internet. All they get are the one that interpreted in HTML. This also meant as well for configuration.php (or config.php) for any web apps.

share|improve this answer

For a stronger security of configuration PHP files you can also lock file for preventing of changing or manipulating them. This will add stronger security.

On a linux server function are chattr and on a VPS server you should lock a file of configurations:

chattr +i /home/user/configuration.ini
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.