linux - How secure is storing sensitive information in a .PHP file on an Apache server? -


I am creating an easy-setup, a database PHP website that stores its data Instead of in text files

Setup is a Linux / Apache / PHP server.

So far the information is non-sensitive , so I store them in: ../atellite/statet.txt In the (url) /data/system.txt you can type and see the data file in plain text, which did not make any difference till now .

But now I want store passwords so that different groups can log in and see different information These sites are marked with " low interest " and " Low profile "sites and if a site gets bored enough to hack and sees information, then this is not the end of the world, I just want to provide an interruption of technical constraints. I so that the site has personal and group access Dikar mills, while maintaining ease These 50 sites without having to set up the 50 sites and maintain.

My question is, what is the best way to protect these text files on Apache?

I can think of the following:

1) Some random directory names ../ data / strong>, e.g. " ../ Data 928374928374 " as a type of vague measurement

2) Change the .txt file to .php and thus protect the text with the PHP code: 

  & lt ;? php echo 'access denied' ; Die; / * ... Store data here ... * /? & Gt;

3) files with .txt and other endings protected A For the / data directory is .htaccess file Put: 

  & lt; file match ". (Sqlite | xml | txt | csv | php) $ "& gt; from all & lt; / FilesMatch & gt;

Here's my idea:

1) I could think that ways to find hidden names of names on the server is this true, is it true?

2) It is that weird is a text file called .php and has PHP code because I want to edit text files with non-tech people and just leave them in the data directory and work them out, "Technical To improve them with "without". Editor for not mentioning this message syntax-color in most.

3) This .htaccess file is all Server will work on For example, if I make a copy of the website for any Apache server, do I guarantee that files will be preserved, or there are other settings that affect the .htaccess files on Apache server Can turn off

<

  1. This will require a brush inquiry, but yes.
  2. That is true, it makes things complicated for non-technical people plus, I imagine that whatever you want, it can not be.
  3. The .htaccess rules will only work for Apache servers, where the directory is allowed to use the htaccess rules (and allows to override parameters, if this is necessary). Also note that some configurations can not be called .htaccess file, but some more. You probably can use SQLite or something that does not really require a database server.

    Another idea is that there should be a structure like 

      / app / public_html / data

    and in public_html Your website is externally excluded from the world and / data is not accessible (only by your scripts).

    In the In / App folder you can create a HACACCase rule that will always redirect all the syntax to the punlic_html folder, so it will not be visible to the external user (it is possible behind the scenes). And if both folders are copies involving the .htaccess file, then it should be sufficient for one-stage deployment


Comments

Post a Comment