0

I'm trying to let Drupal7 connect to several databases(pgsql) and update data automatically. So I use Database::addConnectionInfo($name,'default',$connString) And db_set_active($name).

It works perfectly until I realize it's dangerous to save database password in fields while the connection string actually needs it.

Is there any way to do so easy and safe?

Thank you! :)

  • 1
    You may have better luck on security.stackexchange.com - here we can talk implementation, but to know what to implement, they are just the guys. Long story short, you will need to keep all the data Drupal needs to know full text password in files or database, so if someone will break into your Drupal, all your databases should be considered compromised anyway. – Mołot Apr 26 '14 at 10:49
  • Pgsql support several kinds of connection such as trust and public key. But I'm not sure which way drupal7 also support, excepts put password in connection string directly. I will take a look that site, thank you! – zhuchun Apr 27 '14 at 6:50
  • If you'll give Drupal key to database, it is about as bad as giving it password. I mean, if someone is up there stealing your data, you are only moving what he needs to steal from database entry to another kind of database entry, or file (depends on where you want to store keys). I guess I could investigate how to hack in key support into Drupal, but I can't see a point of doing it. – Mołot Apr 27 '14 at 8:18
  • Are you storing the password? If so: How are you storing the password? Do you use https on the site? Can you encrypt the field? – greggles Apr 27 '14 at 20:56
  • 1
    @greggles encrypt field is what I want to do, until I find a module says you should not encrypt because it's NOT truly safe, just a trick. So I'm trying to find another way. Guys both hit the point, I think if we have to store password in field, a module provide Encrypt/Decrypt API and hard-coded key/salt is a better choice, isn't it? In this case, even my drupal database has been hacked, password is still safe. – zhuchun Apr 28 '14 at 6:29
1

Well, there is the encrypt module which can encrypt your data. Be sure to use the 7.x-2.x branch.

And yes, store the key somewhere on the filesystem that is not easily accessed and it should be hard for an attacker who has db access to be able to decrypt the info.

Just be sure that there's no way to execute php via the Drupal interface. A module like paranoia can help in that.

  • Great! Especially it can use key outside the web root. Thank you! – zhuchun May 3 '14 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.