Encrypting db password stored in settings.php

Question

The db password in settings.php is stored as plain text. Is there any way to encrypt that password?

My client says its a security risk even though the file permissions is as should.

Answer 1

Security is always a matter of compromises. The question is always what threats do you want to protect against and what level of hindrance are you taking.

For example, you could create a small script that asks for the DB password, stores it in shared memory (with APC/APCu) and then change Drupal settings.php to read the DB password from there. Of course, any Apache restart now requires providing the DB password. But, you don't have your password in any file. Compromise, see?

If someone manages to run arbitrary PHP code, for sure they can gain the password but then it doesn't matter much anyways, right?

Answer 2

This is not a Drupal question specifically. Depending on the OWASP security standards you're following keeping the password in plain in settings.php could be considered a risk (in a normal, usual Drupal environment it won't be the case)

This thread on Information Security Stack Exchange discusses the topic, but in my opinion is a little paranoid and most of the options will slow down your site.

Answer 3

It is possible to do this. I have implemented this on my website and also written a post about this here:

http://techrappers.com/post/3508/how-secure-settingsphp-file-drupal

Above articles explain step by step procedure of implementing an encrypted password inside settings.php file with a PHP script and AES-256-CBC encryption method.

Answer 4

Create a new file somewhere on the webserver (mypsswrdfile.php) to which only web admins should have rwx rights to.

In it have them create a variable that holds the password.

$pass = "dbpass";

Include that file in your settings.php and use the variable for the password key.

"password" => $pass,