Not signed in (Sign In)
  • Subscribe

    • Feed
    • CommentAuthorbjoern
    • CommentTimeAug 17th 2009
     
    Since many servers show the Config.ini as plain text and there many users that don't read the manual or the little line at the top.
    My suggestion is:

    a) Rename Config.ini to config.ini.php
    b) Add a new line at the top:
    ; <?php die(); ?>

    I assume the server as registered .php to be handled by PHP. PHPIDS wouldn't work without it anyway.

    This is a security module. I think it shouldn't make it easy to make mistakes that lead to security leaks in a system.

    Just a word about "; !!!DO NOT PLACE THIS FILE INSIDE THE WEB-ROOT IF DATABASE CONNECTION DATA WAS ADDED!!!":
    I think you should never show your configurations. Database settings are not the only sensitive data in a system.
    Knowing that a system uses PHPIDS can be very valuable information for an attacker.
    •  
      CommentAuthor.mario
    • CommentTimeAug 17th 2009
     
    I like that idea - +1 for me to use this trick in the next release. Thoughts?
  1.  
    Yes, and an additional .htaccess file in IDS with

    deny from all

    would be a good additional measure, there appears to be no directly accessed files in the structure.