This is confusing to me.
If this is correct, then why do various scripts amongst which Wordpress and forums, have their config file like wp-config.php just 644.
Ultimately you'd have to ask them. Probably because of the fact that the script developers really can't know what kind of PHP environment the user is going to be using. 644 is a more open permission. 644 will work in a mod_php, mod_ruid2, php-fpm, suphp, phpsuexec environment - effectively every environment. Is it the best solution? Probably not. But at some point the security of
your site becomes
your responsibility and not the script developer's.
On the other hand....using chmod 600 on such fill won't make any difference because php files with chmod 600 can also be read, at least I tested this with a normal php file, copied it to another filename and used chmod 600 on it. And it still got displayed in the browser without any problem.
The PHP output is displayed in the browser, but the PHP code is not.
Create a file - file.php with:
<?php
$login = "root";
$password = "thecakeisalie";
?>
HELLO WOLRD!
?>
Then
chmod 600 file.php - When you visit the file in a browser, what is shown? Are you able to see the login and password information?
Log into the server as another user via shell and try to read the file -
cat /home/user/public_html/file.php - can you read it?
That is what what
chmod 600 file.php in a PHP-FPM environment (or any PHP environment that executes PHP as the user) will give you. In a mod_ruid2 environment the
WHOLE VirtualHost is run as the user, so EVERY file could be set to 600 (or 400 for just the user read bit) and it would still operate.
Way back when - when the whole "symlink protection" was a thing - malicious users on a server (or an account that had been compromised) would create symlinks from another account on the server to the current account:
ln -s /home/user/public_html/file.php /home/myuser/public_html/file.txt - which would allow the user to visit
myuser's website -
myuser.com/file.txt - to read the contents of
/home/user/public_html/file.php. But if you properly understood the Linux filesystem permissions, then this didn't affect you. If
/home/user/public_html/file.php is owned by user:user and has a permission of 600, then only user can read or write to that file -
myuser doesn't have any permission to read it.
This is why any PHP file that contains database login information, such as
wp-config.php - and IF you are operating in an environment where PHP files are executed as the user of that web hosting account, whether that be php-fpm, suphp, phpsuexec or at the Apache level with mod_ruid2, then they should be set to permissions of 600, to prevent other or world users on the server from being able to read the file.
Effectively, the whole symlink protection thing took advantage of people's misunderstanding or not understanding the role that file permissions have in Linux.
