I have a web server with many virtual hosts, config files, etc.

I'd like to track all of my web server & PHP config files using Git and have them hosted on a public GitHub repository, as this will make managing and backing up the files significantly easier. The main website content is already tracked with Git and on GitHub.

I'm aware that web server config files give away information about your web server, such as directory paths, config file locations, hidden files, etc. However, this is primarily security through obscurity, and in a real attack situation, this information would probably be quite easy to enumerate anyway.

This information could also help attackers identify known vulnerabilities or configuration issues, software versions, etc, meaning you may be more likely to be targeted.

My website is a mostly static PHP website, with no place for traditional user form input or any other "Web 2.0" interaction. My blog also already has some documentation on my Apache web server setup, so I'm definitely not trying to keep anything a secret.

Is there anything that I have missed here, and do you think this is a particularly good idea?

  • real security assumes your attacker already knows everything about your system. Any hesitation not to publish is clinging to obscurity (aside from password files and whatnot) – dandavis Mar 15 '18 at 3:41
  • "Any hesitation not to publish is clinging to obscurity" - That's a fantastic statement, sounds like it could be a famous security quote or something! Looks like I'm going to be publishing my config files now, thanks! – jamieweb Mar 15 '18 at 18:12
  • Be careful to redact any credentials which may be in the configuration files. – forest Mar 31 '18 at 7:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.