CiviCRM Community Forums (archive)

Apologies if this is the wrong thread to ask this question, I couldn't see any of the threads dedicated to security, so I am posting here. I noticed that the civiccrm.settings.php file contains important database info. How does one secure it on the server? With most CMS (like Joomla, Drupal, Wordpress) where CivicCRM resides, the configuration files can be moved outside of the root folder away from malicious eyes. What is the implication of moving the this important file away from the CivicCRM folder to somewhere inaccessible via Http call? If it can be moved, what files will need to be modified that references the civiccrm-settings.php file?

Thanks

Ok, if not in Drupal, you can for joomla. The concern is that the civiccrm.settings.php files contains the database user and pwd info. Anyone can access that information from the ftp. That opens the site up for intrusions by hackers. I think this should be a huge concern for everyone using CivicCRM.

Anyone can access that information from the ftp. That opens the site up for intrusions by hackers. I think this should be a huge concern for everyone using CivicCRM.

Sir, first of all if this was a serious security concern, then it would be not be just "a huge concern for everyone using CivicCRM" it would be "a huge concern for everyone using Drupal" as CiviCRM in Drupal is just as secure as Drupal itself, when run in Drupal.

Secondly, anyone with a bit of PHP knowledge and FTP access to your Joomla site can retrieve your database credentials in a matter of minutes no matter where the config file is, so in reality putting your Joomla config file elsewhere doesn't actually provide much protection if a hacker has FTP access to your account.