config files

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Michael G
    #1

    config files

    Hi,

    I have a file outside of the web root and this file contains db
    username/passwds, and other config stuff. I include this file as needed in
    the scripts. Is this a secure way of doing this? Would the contents of
    this file ever be visible to web users under normal or abnormal conditions?

    Thanks, Mike



    ----== Posted via Newsfeeds.Com - Unlimited-Uncensored-Secure Usenet News==----
    http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups
    ----= East and West-Coast Server Farms - Total Privacy via Encryption =----
    Tags: None
    • Andy Hassall
      #2
      Re: config files

      On Thu, 28 Jul 2005 07:31:43 -0600, "Michael G" <mike-g@montana.com> wrote:
      [color=blue]
      >I have a file outside of the web root and this file contains db
      >username/passwds, and other config stuff. I include this file as needed in
      >the scripts. Is this a secure way of doing this?[/color]

      Security is rarely absolute, but this is a pretty good method in most cases.
      [color=blue]
      >Would the contents of
      >this file ever be visible to web users under normal or abnormal conditions?[/color]

      To web users - not under normal conditions, and it would take a severe bug to
      show it under abnormal conditions (i.e. a page that due to a bug allowed direct
      display of arbitrary files).

      Note that this is not fully secure on a shared webhost if the other users of
      that server (not web users - but server users) aren't trusted, as other users'
      PHP scripts are likely to be able to access the file outside the web root if
      they know where it is - it's got to be accessible to the webserver, and other
      users may be using that webserver.

      If the userbase of the server is trusted, this is fine - e.g. you have a
      dedicated server. Even if not, you can make a judgement call as to whether
      other users of the server would jeopardise their investment in hosting by
      "hacking" other users on the same server.

      There are ways of locking this down further, but you'd probably have to run
      PHP as CGI so it ran under your own user credentials - but this has potentially
      serious performance implications.

      --
      Andy Hassall / <andy@andyh.co. uk> / <http://www.andyh.co.uk >
      <http://www.andyhsoftwa re.co.uk/space> Space: disk usage analysis tool

        Comment

        • Raj Shekhar
          #3
          Re: config files

          "Michael G" <mike-g@montana.com> writes:
          [color=blue]
          > Hi,
          >
          > I have a file outside of the web root and this file contains db
          > username/passwds, and other config stuff. I include this file as needed in
          > the scripts. Is this a secure way of doing this? Would the contents of
          > this file ever be visible to web users under normal or abnormal conditions?[/color]

          No it will not be visible to the web users
          --
          Raj Shekhar
          blog : http://rajshekhar.net/blog home : http://rajshekhar.net
          Disclaimer : http://rajshekhar.net/disclaimer

            Comment

            Previous template Next
            Working...