Visibility of /config.core.php

Hi, I'm new to this community, so please accept my apologies if this post is misplaced.

I'm going to some lengths to harden and secure my installs as per the various MODX and community guides. Outside of the straight security aspects (eg move /core and remove /setup), part of this process is to mask the CMS identity in order to avoid fingerprinting (so, re-templating the login page, renaming the /manager etc).

However, you can still simply browse to /config.core.php and get an HTTP 200 / Page Found. Does this not identify MODX and would moving the config file just be a case of updating the reference in /index.php?

EDIT: Removed details of completely unrelated error.

Thanks! [ed. note: matttx last edited this post 12 years, 8 months ago.]

If browsing to that file brings down your web server, something else is wrong in your environment. You could easily prevent access to the config.core.php files by simply denying access to all from the web server.

Yes, of course, denying access would be far simpler - I'll do that. Would that be best practice?

I removed details of the error. You're right - it was purely coincidental and only confused the issue here.

Everything must be able to find the core, so those config files must be in a known location and be available for file streaming as includes. They don't ever need to be available from URLs, so denying from all in an .htaccess directive would be fine.

Perfect, thank you. I see now that this has actually been listed as a feature request: http://tracker.modx.com/issues/10343.

So, rule for .htaccess as per the link above, or this can be added to web.config for IIS hosts.

<rule name="Hide Config Files" stopProcessing="true">
<match url="^(.*)$" ignoreCase="true" />
<conditions>
<add input="{REQUEST_FILENAME}" matchType="Pattern" pattern="config.core.php" />
</conditions>
<action type="Rewrite" url="index.php?q={R:1}" appendQueryString="true" />
</rule>