5

The db password in settings.php is stored as plain text. Is there any way to encrypt that password?

My client says its a security risk even though the file permissions is as should.

  • 2
    As a side note, this issue can be mitigated by having Drupal connect as a database user who (1) can only connect to the database catalog for the site, (2) can only connect from localhost or from the webserver when the webserver and database servers are different machines (and preferably via an RFC 1918 address), and (3) does not have GRANT permissions on the catalog. – mpdonadio Jul 1 '14 at 13:47
1

Security is always a matter of compromises. The question is always what threats do you want to protect against and what level of hindrance are you taking.

For example, you could create a small script that asks for the DB password, stores it in shared memory (with APC/APCu) and then change Drupal settings.php to read the DB password from there. Of course, any Apache restart now requires providing the DB password. But, you don't have your password in any file. Compromise, see?

If someone manages to run arbitrary PHP code, for sure they can gain the password but then it doesn't matter much anyways, right?

  • I thought about putting the password as an apache variable, but as you said, every time the server will restart the password will be lost... And in our servers architecture, its not quite possible also(we have multiple servers with 1 nfs drupal installation). – doron Jul 1 '14 at 20:19
5

This is not a Drupal question specifically. Depending on the OWASP security standards you're following keeping the password in plain in settings.php could be considered a risk (in a normal, usual Drupal environment it won't be the case)

This thread on Information Security Stack Exchange discusses the topic, but in my opinion is a little paranoid and most of the options will slow down your site.

  • 2
    Upvoted for a link to an existing and more thorough discussion. – greggles Jul 1 '14 at 3:37
0

It is possible to do this. I have implemented this on my website and also written a post about this here:

http://techrappers.com/post/3508/how-secure-settingsphp-file-drupal

Above articles explain step by step procedure of implementing an encrypted password inside settings.php file with a PHP script and AES-256-CBC encryption method.

-2

Create a new file somewhere on the webserver (mypsswrdfile.php) to which only web admins should have rwx rights to.

In it have them create a variable that holds the password.

$pass = "dbpass";

Include that file in your settings.php and use the variable for the password key.

"password" => $pass,

  • 2
    Your solution still doesn't encrypt the password... There is no difference between your solution with the current state because the file has the needed permissions... – doron Jul 1 '14 at 6:20
  • 1
    Good luck with that. Please provide us the solution if you find it because in eager to know myself. Thanks – Emir Memic Jul 1 '14 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.