phpbb2 config.php vulnerability

[perfx]

iv'e noticed that my phpbb2 forum config.php file with access username and password to mysql database can be viewed by everyone who has a shell account in my server.

how do i hide password or limit the access to config.php ?
when i change rights for global access forum just stops working...

[jasonlambert]

Ultimatly there is very little you can do to stop people reading that file.

You could chroot their ssh session which would stop them reading it from the shell.

However.. if they have webspace on your server then be aware they would still be able to write a php/perl script which could read your config.php if they knew its path.