PDA

View Full Version : HOWTO: Secure your vBulletin sensitive data


TECK
27 May 2007, 02:58
vBulletin is a very secure web application. Except the fact that it has the database, user name and password included into a readable text file.
There is a very simple way to correct this issue.
Basically, you grab the sensitive information and you move it outside the public area.

Secured vBulletin config.php file
Let's presume your server has the following structure:
/root
--/etc
--/usr
----/etc
--/var
----/www
------/html
--------/forum
----------/includes
Start by opening your config.php file:
[root@Linux-PC ~]# gedit /var/www/html/forum/includes/config.php

Paste inside the PHP EOF key (?>). It probably got deleted by accident in one of the SVN branches. It should look like that:
/*======================================================================*\
|| ####################################################################
|| # Downloaded: 17:35, Wed May 16th 2007
|| # CVS: $RCSfile$ - $Revision: 16258 $
|| ####################################################################
\*======================================================================*/
?>

Now, run those commands:
[root@Linux-PC ~]# mkdir /etc/vbulletin
[root@Linux-PC ~]# mv /var/www/html/forum/includes/config.php /etc/vbulletin/config.php
[root@Linux-PC ~]# ln -s /etc/vbulletin/config.php /var/www/html/forum/includes/config.php
[root@Linux-PC ~]# chown -R lighttpd:root /etc/vbulletin
[root@Linux-PC ~]# chmod 0640 /etc/vbulletin/config.php

I really hope you use nginx (http://www.vbulletin.com/forum/showthread.php?t=253741) or lighttpd as web server, not Crapache, the resources hogger who eats memory like an elephant. Large sites like YouTube, Sourceforge, Alexa, etc. use it, you should also.

Secured MySQL vBulletin user
Start by creating a new database user:
[root@Linux-PC ~]# mysql -u root -p
Enter password: n50Ig7vYzXy2sXfc
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 43 to server version: 5.0.22

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> GRANT ALTER, CREATE, DELETE, DROP, INDEX, INSERT, LOCK TABLES, UPDATE, SELECT
ON vbdatabase.*
TO 'vbuser'@'localhost'
IDENTIFIED BY 'Ov4d4wk1BVXDllh9';
mysql> FLUSH PRIVILEGES;
mysql> SELECT Host, User FROM mysql.user;
+-----------+--------+
| Host | User |
+-----------+--------+
| localhost | root |
| localhost | vbuser |
+-----------+--------+
mysql> quit

Note: Did you know that you can paste a password into your telnet window?
No need to memorize them... so you can use very complex passwords in your Linux configuration. :)

The privileges listed above are the only ones vBulletin needs for any operation, including upgrades.
Make sure you have only the users you need/use, in your MySQL database.
Hosts or users defined as "" are dangerous because they open the door to security issues.
The MySQL site tells you how to secure your user accounts (http://dev.mysql.com/doc/refman/5.0/en/default-privileges.html), very well.

Also, I strongly suggest you to use at least 85 bits, for the quality of your server passwords.
A very good tool to generate and have all your passwords grouped together is KeePass (http://keepass.info/).
It will store very securely all your important passwords. The beauty of this program is the fact that you can keep it on your USB flash drive and travel with it everywhere. Plus, it is free and works on Windows, Linux and MacOS.
I use it all the time to generate very strong passwords for all my server configurations.

Shared Accounts
If you are on a shared account, get a server. vBulletin was not meant to run on a shared account. Once your forums are getting a little popular, the site will die on you constantly.

That's all, enjoy your secured config.php file as well the secured MySQL user. :)

Princeton
27 May 2007, 14:23
Great article TECK!

Thanks for sharing with the community. :up:

TECK
01 Jun 2007, 17:09
Thanks, Princeton.

Sweeks
23 May 2009, 16:19
A long time since you have wrote this but thank you, I have enjoyed the read :)
________
EASY VAPE"" REVIEW (http://vaporizer.org/reviews)

almohd
01 Jun 2009, 08:11
Thank you

J105C
29 Jul 2009, 02:46
Yeah, this doesn't seem to work with apache.

It doesn't work with config.php what so ever.

When I use a test html file it works though, I can view it in the browser. But I have to chmod the file to 644 and the folder in /etc location to 755

narhot
07 Sep 2010, 02:49
Explain the awesome my brother thanks you and experience ...