Potential Security Risk: Database Backups

Scott MacVicar, vBulletin developer, has pointed out a potential security risk, leaving database backups generated from the admin panel in public accessible folders on the web server. It is recommended that all backups are saved in an alternate folder below the web root so that unauthorised users are unable to download this backup.

In an attempt to resolve any confusion in future releases vBulletin will have suffixed the database backups with a random 5 character string and a more visible warning to administrators within the backup page.

I read that, however, he has it backwards it would seem. You walk the file system tree downward into folders. The backups should be in a folder ABOVE the public root folder.

The tree of a typical account is /home/accountname/public_html
public_html being the web root, the public folder. The folder /home is referred to as the TOP level directory.

The backups should be in /home/accountname/backup_file.sql

Better yet, create a folder called backup. ie. /home/accountname/backup
and store your backups as /home/accountname/backup/backup_file.sql
for better organization.