I am running a LAMP stack on Ubuntu 12, with the primary function to serve a PHP based API.
There is only one file I want to be exposed to the public called: api.php
It needs to reference a config file I have in /cfg/api-config.php
which contains db passwords so the API can write to the database etc.
So I only want the api.php
to be 'served' by apache and made public.
The config file I put in /cfg must be readable by the api.php but not by anyone who might visit the site.
I have no .htaccess
, just a httpd.conf
configured as per the below.
<VirtualHost *:44448>
DocumentRoot "/api"
ServerName localhost:44448
ServerAlias Server.local
DirectoryIndex index.html
CustomLog "/var/log/apache_access.log" combined
ErrorLog "/var/log/apache_error.log"
SetEnv APPLICATION_ENV development
php_flag magic_quotes_gpc off
<Directory "/api">
Options Indexes MultiViews FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
Permissions on my /cfg
and /api
folders are: drwxr-xr-x
and permissions on my sensitive config file with db password located in /cfg/api-config.php
is -rw-r--r--
I was wondering if anyone can tell me if this is set up correctly and safe?
Whereby:
A) All files other than the /api/api.php
are not public, and no access can be gained to my servers files.
B) The config file with the passwords for db (for the api) is also not readable by anyone visiting the site?
I have tried to test this by creating a new folder in /cfg
with chmod 777
, and I can't seem to access it, which is good!
/cfg
(located in the root level of the filesystems) should be readable by the UID running the web server, only, and of course not be located anywhere under the DocumentRoot. Remove the options for Directory `/api'.