By benoit.borrel on

Hello,

In order to secure my D5 installation, I would like to:

  1. Encrypt settings.php
  2. Move settings.php outside the web host document root

    3. Has anyone any idea on how to realize the above 2 modifications?

    Thanks in advance

⋅ Categories: Drupal 5.x

Comments

jabapyth’s picture

jabapyth commented

your file permissions, coupled with a .htaccess file denying all to access settings.php should secure it sufficiently. What attacks are you looking to defend against? as for moving the file outside your webroot, you could edit includes/bootstrap.inc, function conf_dir (line 232) to hard-code in your configuration directory.

Grimlock’s picture

Grimlock commented

I copied my settings.php file to my user directory e.g. /home/mywebsvrusr/settings.php. Next I deleted the contents of settings.php and put in

<?php

require( '/home/mywebsvrusr/settings.php' );

?>

Works like a charm!