Folder permission for include folder

[bnashenas1984]

Hi everyone

Can anyone tell me what folder permission I should have for the folder containing MySQL passwords.

I have a directory which contains a PHP file with MySQL password. This file gets imported ( require("passes .php") ) at the top of each page.

And I have another folder containing other include files like functions.

Can you please explain what folder permissions I need to have for each one of these folders in order to prevent visitors to open or download them .

Thanks / Behzad

[Dormilich]

Can you please explain what folder permissions I need to have for each one of these folders in order to prevent visitors to open or download them.

if your php files do not produce output (aka blank page) opening or downloading the files (via http) don’t expose your passwords. however you should make sure that you prevent folder listing.

[Atli]

I would suggest that you set the permissions as low as you can get away with.

Give the user running Apache ownership of the file, give it read-only access to it, and deny everybody else all privileges on it. That should make it pretty safe.

Also, just to prevent any possible problems, it is advicable to put files containing sensitive info outside the web-root, and include them using absolute paths.

Meaning, if your website files are stored in the path /var/www, you should set your files up something like:

/
  var/
    www/
      index.php
      styles.css
      etc...
    includes/
      mysql_info.php
      other_sensitive_stuff.php

And include it in your index.php file like:
[code=php]
<?php
include('/var/includes/mysql_info.php' );
// etc...
?>[/code]

[bnashenas1984]

Thank you Atli and Dormilich for your posts.

Like you said I guess the best way is to put the security file outside the server root to prevent any external access.

Any way.. The reason I posted this question is that as soon as I changed the permissions I felt some decreasing speed on the server. I mean it apears that it takes longer time for the page to load.

I know it's not logical and it might be because of some other reason. That's why I posted this to make sure the permissions i'm using are right.

I have (011) for the folder containing MySQL passwords and (755) for other folders

Thanks / Behzad