vBulletin LTS

HOWTO: Secure your vBulletin sensitive data

by TECK 27 May 2007

Rating:

(1 vote - 5.00 average)

vBulletin is a very secure web application. Except the fact that it has the database, user name and password included into a readable text file.
There is a very simple way to correct this issue.
Basically, you grab the sensitive information and you move it outside the public area.

Secured vBulletin config.php file
Let's presume your server has the following structure:

Code:

/root
--/etc
--/usr
----/etc
--/var
----/www
------/html
--------/forum
----------/includes

Start by opening your config.php file:

Code:

[root@Linux-PC ~]# gedit /var/www/html/forum/includes/config.php

Paste inside the PHP EOF key (?>). It probably got deleted by accident in one of the SVN branches. It should look like that:

Code:

/*======================================================================*\
|| ####################################################################
|| # Downloaded: 17:35, Wed May 16th 2007
|| # CVS: $RCSfile$ - $Revision: 16258 $
|| ####################################################################
\*======================================================================*/
?>

Now, run those commands:

Code:

[root@Linux-PC ~]# mkdir /etc/vbulletin
[root@Linux-PC ~]# mv /var/www/html/forum/includes/config.php /etc/vbulletin/config.php
[root@Linux-PC ~]# ln -s /etc/vbulletin/config.php /var/www/html/forum/includes/config.php
[root@Linux-PC ~]# chown -R lighttpd:root /etc/vbulletin
[root@Linux-PC ~]# chmod 0640 /etc/vbulletin/config.php

I really hope you use http://www.vbulletin.com/forum/index.php?t=253741 or lighttpd as web server, not Crapache, the resources hogger who eats memory like an elephant. Large sites like YouTube, Sourceforge, Alexa, etc. use it, you should also.

Secured MySQL vBulletin user
Start by creating a new database user:

Code:

[root@Linux-PC ~]# mysql -u root -p
Enter password: n50Ig7vYzXy2sXfc
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 43 to server version: 5.0.22
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql> GRANT ALTER, CREATE, DELETE, DROP, INDEX, INSERT, LOCK TABLES, UPDATE, SELECT
	ON vbdatabase.*
	TO 'vbuser'@'localhost'
	IDENTIFIED BY 'Ov4d4wk1BVXDllh9';
mysql> FLUSH PRIVILEGES;
mysql> SELECT Host, User FROM mysql.user;
+-----------+--------+
| Host      | User   |
+-----------+--------+
| localhost | root   |
| localhost | vbuser |
+-----------+--------+
mysql> quit

Note: Did you know that you can paste a password into your telnet window?
No need to memorize them... so you can use very complex passwords in your Linux configuration.

The privileges listed above are the only ones vBulletin needs for any operation, including upgrades.
Make sure you have only the users you need/use, in your MySQL database.
Hosts or users defined as "" are dangerous because they open the door to security issues.
The MySQL site tells you how to http://dev.mysql.com/doc/refman/5.0/en/default-privileges.html, very well.

Also, I strongly suggest you to use at least 85 bits, for the quality of your server passwords.
A very good tool to generate and have all your passwords grouped together is http://keepass.info/.
It will store very securely all your important passwords. The beauty of this program is the fact that you can keep it on your USB flash drive and travel with it everywhere. Plus, it is free and works on Windows, Linux and MacOS.
I use it all the time to generate very strong passwords for all my server configurations.

Shared Accounts
If you are on a shared account, get a server. vBulletin was not meant to run on a shared account. Once your forums are getting a little popular, the site will die on you constantly.

That's all, enjoy your secured config.php file as well the secured MySQL user.

vblts.ru supports vBulletin®, 2022-2024