Securing - config.php

[UseLess]

Greetings,

To make the contents of 'config.php' a little more secure you can add the following to the top of the file;

Code: Select all

if ( !defined('IN_PHPBB') )
{
   die("Hacking attempt");
}

this will then result in this if someone tries to access the file directly.

The complete file should then look like this;
[code highlight="11,13-16,18"]<?php

if ( !defined('IN_PHPBB') )
{
die("Hacking attempt");
}

// phpBB 2.x auto-generated config file
// Do not change anything in this file!

$dbms = 'mysql';

$dbhost = 'localhost';
$dbname = 'your db name';
$dbuser = 'your db username';
$dbpasswd = 'your db password';

$table_prefix = 'phpbb_';

define('PHPBB_INSTALLED', true);

?>[/code]
In the above the highlighted lines may be different in the file you have due to the different db server and the other connection settings along with a different table prefix if your not using the default of 'phpbb_'.

Adding this check to the file should not affect any mods installed on the forum. However, if you start getting 'hacking attempt' messages then make sure 'IN_PHPBB' is defined before including 'config.php'.

Also make sure that the file 'config.php' is CHMOD'd to 644

[Disturbed One]

In addition to this, I place my config.php in a different directory (say /admin/ for example), and I rename it (/home.php or similar).

This won't do much if somebody was able to get access to your files, but it will not be as easy for them to find your database connection information.

[Disturbed One]

Giga4000 also states that putting this code into your .htaccess should prevent people from reading the file online, but still lets phpBB read it.

Code: Select all

<Files config.php>
Deny from all
</Files>