I am running a LAMP stack on Ubuntu 12, with the primary function to serve a PHP based API.
There is only one file I want to be exposed to the public called:
It needs to reference a config file I have in
/cfg/api-config.php which contains db passwords so the API can write to the database etc.
So I only want the
api.php to be 'served' by apache and made public.
The config file I put in /cfg must be readable by the api.php but not by anyone who might visit the site.
I have no
.htaccess, just a
httpd.conf configured as per the below.
<VirtualHost *:44448> DocumentRoot "/api" ServerName localhost:44448 ServerAlias Server.local DirectoryIndex index.html CustomLog "/var/log/apache_access.log" combined ErrorLog "/var/log/apache_error.log" SetEnv APPLICATION_ENV development php_flag magic_quotes_gpc off <Directory "/api"> Options Indexes MultiViews FollowSymLinks AllowOverride All Order allow,deny Allow from all </Directory> </VirtualHost>
Permissions on my
/api folders are:
drwxr-xr-x and permissions on my sensitive config file with db password located in
I was wondering if anyone can tell me if this is set up correctly and safe?
A) All files other than the
/api/api.php are not public, and no access can be gained to my servers files.
B) The config file with the passwords for db (for the api) is also not readable by anyone visiting the site?
I have tried to test this by creating a new folder in
chmod 777, and I can't seem to access it, which is good!