Securing PHP on webhost

Anon

I'm having my PHP (with db) apps professionally webhosted. I developed using IIS 4.0 but will be deployed using webhost's Linux/Apache/PHP4.

Would appreciate advice on best way to secure my PHP scripts and db at the webhost. Particularly, how do I hide the username and password used by PHP to access the db? Is there a way to hide/encrypt such that even webhost operator (as superuser) cannot see the username & password? I code the username and password in a single include file. All db access are done through this include file.

Thanks to all.

Anon

There are little ways to protect your php script.

First, you should make sure the directory the script is in has 701 so just in case if anyone tries to list your directory. they won't see the file name to view the codes locally.

You're pretty much safe from remote attack. Just make sure you don't have one of those programs that let you see any file in your directory like, view.php?/home/user/blah == really bad.

Having your directory 701 should protect you from local users on the webhost.

Quoc Le
Ares Network
http://www.aresnetwork.com

mithril

GPF,

Well......... you could look at the Zend Encoder. But, you still can't prevent your host companies admin from accessing your database. Even if you change the password on your db account, they will still have a superuser account that gives them full control over all client db's on their system. If you're storing sensitive info that can't leak out (credit card #'s or medical histories for example) your options are either to use two separate companies for hosting, one for http and one for database. This will most likely be slow plus it opens up other potential security risks since the info needs to be transmitted back and forth. The other option, probably the better one, is to use PHP's mcrypt() functions to encrypt the database info before it's stored and decrypt it upon retrieval. This means of course that your host has to be running *Nix and support mcrypt. I don't know of anyone who has mcyrpt running on Win32. Good luck!!

Cheers,

Geoff A. Virgo

Anon

Sorry, Geoff that won't work. If they have root access to the server they can decrypt any data. Just makes it harder since they'll have to look for the code you're using.

GPF,

Is this a dedicated server? If so the webhost doesn't need root access. You should change root password as soon as you have access. Make sure that your rc files will start all your services back up so that all your host has to do if there is any problem is reboot the server.

If it's not a dedicated server then you shouldn't be storing ANY sensitive data on it.

Anon

Rod, the apps is not running on a dedicated server. The data is semi-sensitive (i.e. personal info but no credit card info). Cannot afford a dedicated server yet so using a virtual webhost.

My concern is with site-ripping programs that download an entire website for off-load reading (more like for code pirating). Anyone know if using .php extensions entirely rather than .html will foil site-ripping programs? Any ideas how to fend-off site-ripping attacks?

Thanks.

mithril

Opps🙁 Sorry to post inaccurate info.

rod k wrote:

Sorry, Geoff that won't work. If they have root access to the server they can decrypt any data. Just makes it harder since they'll have to look for the code you're using.

Anon

I'm not sure what you are getting at here.

If your server is configured correctly the only way anyone can access your PHP code is thru the filesystem -- meaning they'd need FTP or Telnet access. You can't access PHP code via HTTP (again assuming the server is configured correctly).

The only thing they can get via HTTP is the resultant HTML output of your PHP script. There is ABSOLUTELY NO WAY to prevent that.

Anon

Thanks Rod, I understand there is no way to protect the underlying HTML code generated by PHP. That's OK with me. It's the PHP code itself because it has the db username/password in one of the include files.

I don't know how sophisticated site-ripping programs have become. I think I read of one program that can rip files other than the basic .htm and images files.

Thanks again.