protect .config file (password) with perms