[Forum] Can I delete the "install" directory from server after vB upgrade?

[SCH]

Hi all,

I recently completed the upgrade to vB 4.2, and other than a few minor questions I still have re: suspect files (posted in this thread) I was wondering if I can delete the install directory (and all it's sub directories) from the server? Are any of the files located in the install directory used by vB after the upgrade? If not then in theory I should be able to delete the directory without harming my site, but I don't want to do so without making sure.

Thanks very much in advance.

[Zachery]

If you really want to, yes the 4 xml files can be used in there.

[borbole]

Hi all,

I recently completed the upgrade to vB 4.2, and other than a few minor questions I still have re: suspect files (posted in this thread) I was wondering if I can delete the install directory (and all it's sub directories) from the server? Are any of the files located in the install directory used by vB after the upgrade? If not then in theory I should be able to delete the directory without harming my site, but I don't want to do so without making sure.

Thanks very much in advance.

Yes, you can safely delete it. However I think you will need it again if you would need to run the tools.php for some reason.

[SCH]

Hi Zachery,

Thanks for the quick response.

Which 4 xml files might be used by vB? My install directory currently has 7 different xml files.

[Zachery]

Sorry! they've gone up recently, the xml files can be left in there, and leaving a blank index.html or index.php would be wise as well.

[SCH]

OK, I'll do that then - I'll delete all the files (and folders) within the install directory with the exception of the .xml files and a blank index.php file.

Thanks for the help!

[Elsmarc]

Old thread, but some year back I just started renaming the install directory something like install-ehd648jft5 - No one is going to guess it and if you need anything in it just a quick, temporary rename to simply install and do what you need to know. Just like the admincp directory - But in this case permanently Rename it so that no one can guess how to get into your adminCP.

[Mark.B]

Old thread, but some year back I just started renaming the install directory something like install-ehd648jft5 - No one is going to guess it and if you need anything in it just a quick, temporary rename to simply install and do what you need to know. Just like the admincp directory - But in this case permanently Rename it so that no one can guess how to get into your adminCP.

Security by obscurity is no security at all.

We do not recommend the method above. Deleting the install directory is the only officially supported process.

[Elsmarc]

Technically, yes. I have had servers online since 1996 (vB since 2001) and never once had a break-in, but I do agree with you. Sometimes, for some things, it's OK - Put in a .htaccess file to restrict logins, make sure your firewall is correctly configured, etc.

My adminCP is set up the same way - Directory renamed, .htaccess file, strong password, etc.

What would you have people do with their adminCP directory - Delete it as well and only upload it when it is needed?

I rely as much on quality, well tested code (from vB in this case) as I do securing the server, public directories and my firewall.

Bottom line is if the code is good (in this case vBulletin) and your server is secure (including firewall and correct permissions for directories, etc., "social engineering" is the most significant method of someone "breaking into" a server. Or so I read in the information security forums, web sites, etc., that I visit.

The reality these days is no server is totally "secure". One does the best one knows how hoping a zero-day exploit isn't found and used by the "bad guys".

Add - Don't know how to get my old access back to my original access here, but I've been on here (probably under Marc Smith) for years. I'm in my 60's and can't remember what the situation was that I had to reset my old account. I "joined" long before March 2014.

[BirdOPrey5]

Add - Don't know how to get my old access back to my original access here, but I've been on here (probably under Marc Smith) for years. I'm in my 60's and can't remember what the situation was that I had to reset my old account. I "joined" long before March 2014.

Please log into the Member's Area an open a support ticket, we'll see what we can do. Include any old email addresses you may remember for the account.