n98-magerun.phar Security Best Practice

Question

I have recently inherited a Magento site that has n98-magerun.phar sitting, publicly accessibly, on the site's home directory. I know that this is a command line tool, but I wonder if it should be publicly accessible, and it if it should be below web root. (This might be an issue if, for instance, it accepts query string parameters or can otherwise be run by a web request.)

Answer 1

I would consider it untidy at the very least to have in the web root, especially in Magento 2 where they have made an effort to separate public files from everything else. It's always good to reduce your attack surface!

Luckily magerun does not need to sit in the web root to function. As per their documentation, we can pass the Magento root directory as an argument to the command:

n98-magerun.phar --root-dir=/path/to/magento

It may even be worth placing it somewhere else entirely, such as /usr/local/bin and then setting up an alias in your .bashrc to run from anywhere:

alias magerun='/usr/local/bin/n98-magerun.phar --root-dir=/path/to/magento';