Viewing the configuration.php

Question

My understanding is that you should never host your configuration.php file within the public_html directory (I am specifically referring to Joomla, but I imagine this is a cross-platform scenario).

My question is: is it at all possible for a user to access/view this configuration file over the internet, or would they first have to exploit the server and then use that exploit to access the config file. In other words, is the best-practice of keeping configuration.php outside of the web root purely to stop a minor exploit from escalating higher, or does the file's existence provide a vulnerability in and of itself?

Answer 1

A configuration file is not publicly viewable over the internet as long as the permissions are setup correctly. Configuration files usually do not output any data directly anyway.

They are able to download a copy of the configuration file if they exploit your server and gain access via methods such as SSH, FTP or through a web-based control panel.

Keeping the configuration.php file outside of the web root directory does increase the level of security, however if an attacker was to compromise your server and gain full access then they are still able to access this file.

Answer 2

For a stronger security of configuration PHP files you can also lock file for preventing of changing or manipulating them. This will add stronger security.

On a linux server function are chattr and on a VPS server you should lock a file of configurations:

chattr +i /home/user/configuration.ini

Answer 3

With a normal web server configuration (at least in most web hosting companies), any PHP files cannot be access directly by visitors over the Internet. All they get are the one that interpreted in HTML. This also meant as well for configuration.php (or config.php) for any web apps.