ebaobao:
hi knuckle,
Something I want to point out. in the installation instructions it says admin/includes/configure.php can be set to 644 or 444. Since I can set either with my ftp, is 444 more preferable since its not writable at all?
Second question is since we are trying to hide our admin directory by renaming it, what good is that if we have to put the new name in admin/includes/configure.php and that file is readable? (444).
If your web hosts allows the permissions 444 then you cannot edit this via FTP Client the permissions 444 is particularly targeted to edit within file manager (root) of the files to help protect against exploiting on fully writable files. Nevertheless you would be able to edit the file using the file manager in the back end such as cPanel, Plesk etc..
If you are only able to use 644 this is somewhat protection which is what we call "Old School" permissions then it is directly editable within the FTP Client which still allows writable permissions where 444 does not..
Examples below may help depending how technically inclined you are
Read and write permission for owner, read-only for group members and all others:
chmod 644 filename Read, write and execute for owner, no access permission for others:
chmod 700 filename Read only for owner and others:
chmod 444 filename If the owner turns off his/her own write permission, the file is protected from accidental or exploiting destruction.
Overall for the best protection against the two configure.php files it is best if allowed to set them 444. Hope this helps.. :cool:
PCI Certified Web Hosting - ControlScan, Security Metrics (Platinum Partner), McAfee, TrustKeeper
Business Class Web Hosting - Linux and cPanel Powered