1

I am building a site that holds information about my client's computers. One piece of information I want to store is the password for an account on each computer. I want my authenticated users to be able to log on to my site and, if they have the right permissions, be able to see these passwords (maybe by clicking a 'show password' button).

The problem with this is that I can't store just the hashed versions of these passwords in the database because obviously then there is no reliable way of getting them back to plaintext, and I don't want to store the passwords as plaintext in the database either (unless access to this part of the database is strictly password protected by my authenticated user's passwords, which I don't know how to implement), so I was wondering if anyone has any suggestions of securely providing this functionality?

Making the passwords secure and retrievable in Drupal seems mutually exclusive to me so if anyone knows of any external services that might work then I would be very interested in hearing about them as well.

I am using Drupal 7.41.

1

I would recommend AES. It provides strong two way encryption and if you have gov't clients, this module uses FISMA/FIPS approved algorithms. This link may also be useful. https://groups.drupal.org/node/258513

  • Thank you, went with this one in the end, hopefully very secure if I have implemented it correctly – dippynark Nov 20 '15 at 16:22
2

Try either the Field Encrypt module:

Adds options to encrypt field values.

The goal of this module is to create a method for encrypting field values when stored in the database.

This module depends on the Encrypt module (http://drupal.org/project/encrypt) for encrypting and decrypting strings.

Or which sounds better for your use-case of "settings" the Encrypted Settings Field module:

This module adds the "encrypted settings" field through Field API, which has the following two features:

  • The field can be encrypted before saving to the database
  • The field can be validated to follow INI format

This module is ideal to save credential settings information, such as a "Credit Card" field to add to users' profile.

A more developer friendly form which stores the final encrypted value into the drupal database and plays nicely with Drupal 7 core Form API elements is the Encrypt Form API module:

After installing and enabling this module, you will be able to add an '#encrypt' property to any of the following supported Form API element types:

  • textfield
  • textarea
  • checkboxes
  • checkbox
  • radios
  • radio
  • select
  • password
  • password_confirm

To use this module I would recommend assuring your site is served only in SSL, then the contents of the field is encrypted on save, after normal form validation occurs.

  • Went with the AES module in the end, but these still seem like very good modules to know about – dippynark Nov 20 '15 at 16:24
0

this breaks the security concept and is not recommended !

why do you need that ?? could there be a better approach ??

you could add a field with a validation to the user entity, which the users has to input the password. so he'll type it 3 times, and it's not encrypted in the DB .. you'll need to do that yourself, fe. with help of encrypt

to not remember passwords there are password managers like lastpass.

  • Your approach seems rather brittle. There are existing contributed modules in this space for this type of functionality in Drupal. A website should be able to store and do many things -- as a web developer i'm not in the business of telling my clients no typically. As example modules see my reply to this post. – tenken Nov 19 '15 at 23:48
  • did not see the field encrypt module ... it's not about saying no - but about concerning about security, and teach the client ! we're not playballs .. and if it runs on my environment, i won't allow it .. and depending on the need, there might be other solutions .. – rémy Nov 20 '15 at 11:29
  • Just because I am building a system for a client who wants this to be possible. The AES module API seems to work perfectly for my use case. – dippynark Nov 20 '15 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.