3 ms·
How utterly stupid do you have to be to engineer software that requires you to have configuration files in a publicly accessible folder? Even most shared hosts
by antihero 14y ago
How utterly stupid do you have to be to engineer software that requires you to have configuration files in a publicly accessible folder? Even most shared hosts now will have a public_html folder and the ability to put sensitive stuff not inside it.
The .htaccess hacks are great but they are just patching the symptom, and one slip up and you're back to square one.
The best way to do configuration is to have it in environment variables that are populated in a completely separate config file for the specific instance, so for instance a uWSGI ini file.
This is very easy with Django and uWSGI.
In your uWSGI.ini:
env = DJANGO_SETTINGS_MODULE=yoursite.settings.production
env = DJANGO_SECRET_KEY=herp
env = DJANGO_DB_PASSWORD=derp
In yoursite/settings/production.py
from .base import *
In yoursite/settings/base.py
import os
DATABASES = {
'default': {
...
'PASSWORD': os.environ.get('DJANGO_DB_PASSWORD'),
...
}
}
SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')
I'm not sure if this is possible with WordPress or the whole shitty PHP way of doing things - perhaps if you had a FPM pool for each site and site specific configuration in there?
- Kudos 14y agoYou are correct, you could do almost exactly the same thing in "the whole shitty PHP way of doing things" using FPM pools.
- antihero 14y agoExcellent! Part of me wants to have a play and see how closely I can get a PHP/FPM/nginx to resemble my Python/uWSGI Emperor/nginx stack. You can do stuff like include /srv/*/pool.ini, right?
- sirn 14y agoYes you can. Dotdeb's php-fpm.ini even includes this line by default: ; To configure the pools it is recommended to have one .conf file per ; pool in the following directory: include=/etc/php5/fpm/pool.d/*.conf Then you could configure ENV inside FPM pool using the env directive: env[DB_HOST] = localhost env[DB_USER] = foobar env[DB_PASSWORD] = foobar ...and use something like this in e.g. Wordpress config: define('DB_NAME', getenv('DB_NAME')); define('DB_USER', getenv('DB_USER')); define('DB_PASSWORD', getenv('DB_PASSWORD')); The biggest caveat is you MUST disable phpinfo() php_value[disable_functions] = phpinfo Otherwise these ENV will shown up in any page that calls phpinfo();
- antihero 14y agoThat's pretty handy. Didn't think about the phpinfo thing, actually, though in all fairness if they managed to upload any PHP files you're rather screwed. I think the way to be secure would be to not actually serve PHP files in the document root and instead have nginx proxy / directly to the FPM pool, and just alias your static files over, much as one would with Django.
- mylittlepony 14y agoIf you wanna see php done right, forget about all the crap you have seen and take a look at symfony.com. It has great docs, that focus on teaching web development (not just a framework) and all these sysadmin best practices like how to set the permissions, etc. Trust me, I have used every popular framework (including Rails and Django), and Symfony2 has nothing to envy.
- akx 14y agouWSGI is capable of serving PHP, mind.
- shakesbeard 14y agoBecause your average graphics designer or blogger has no idea what Apache is, what public directories or file permissions are. They just want to run their own blog. That's why Wordpress (or PHP for that matter) is successful; it's easy to set up and get started.
- antihero 14y agoIn that case why not just host it at wordpress.com where it's managed by people who are (presumably) more experienced?
- jasonlotito 14y agoThere could be many reasons, not the least of which is that the hosting provider would be providing the installation and updates for the user. So, they are paying for it by people who are presumably more experienced. Edit: Just to be clear, I'm not excusing any of the mistakes. Just pointing out how normal people could get screwed over, even if they are using a "professional service" and paying for it.
- kmfrk 14y agoThe best way to do configuration is to have it in environment variables Isn't it the only sensible way, actually? Django doesn't expose static files the same way, so you still get away with a secret.txt stored as a file.
- killahpriest 14y agoHow utterly stupid do you have to be to engineer software that requires you to have configuration files in a publicly accessible folder? Even most shared hosts now will have a public_html folder and the ability to put sensitive stuff not inside it. Complete untrue. You can (and are advised to) move your wp-config.php above public_html. The reason its not done by default is because you just can't do this on many of the crappy hosting services, and it creates a barrier for entry for people making their first-ever site.