Support

You'd better take a look at your PHP error logs around the time of the backup. I think that either your host disabled PHP's set_time_limit() or that suddenly the script can't load the backup engine's files.

Moving the file outside of the site's root offers zero protection. If I were a hacker, I would follow either of these routes to exploit your site:

1. Using an RFI attack vector I would simply dump JConfig's properties from within Joomla!. Game over.
2. Using a rogue upload attack vector I'd append a bit of malicious code in your index.php which dumps JConfig to a file and/or send it to me by email. Game over.
3. Using a blind SQLi attack I'd create myself a Super Administrator user and use it to log in to your site's back-end. Then I'd have full access to your configuration and I'd be able to block you out as well. Double dose of game over.

Half-baked security measure can not really stand between a resourceful hacker and your site. It's like using a clay wall to stop an assaulting tank. It will stall the attack for a few minutes, but that's all there is to it.

So, no, I don't consider moving configuration.php a good idea. It's an unnecessary thing to do which makes your life miserable whenever you update Joomla! or try to use software like Akeeba Backup's CRON script.

You're welcome, Mads!