|
Posted by Chung Leong on 04/29/06 20:33
Pointless rant. In a typical set up the database server isn't
accessible to the outside world, so the risk of exposure through a
misconfigured web server isn't that unreasonable to take. The database
login/password is only useful to someone who can access the
database--i.e. another account on the same server. Putting your config
file your home directory does not prevent him from reading it.
Ideally any sensitive info should be stored in httpd.conf, readable
only by root.
Navigation:
[Reply to this message]
|