IMO both previous answers (posted with 10 secs difference ...) are incomplete ...
The /sites/default/settings.php
file indeed does contain that userid and password, and if you "don't want him to see the username and the password of my database" (as in your question), then you at a minimum remove that userid and password (which you want to keep secret) in that file.
However, your question also contains this:
Is it sufficient if I change the username and the password in this file?
To keep your userid and password secret you are done with only this change. But if you want your colleague to be able to actually use the Drupal installation you want to send, then IMO the answer to that question is NO. Because Drupal requires that the /sites/default/settings.php
file that your colleague will be using contains the userid and password that matches with the database after it is restored by your colleague.
Note (credits: sanzante): you should also send your colleague a database dump. And your colleague only has to import the database and edit the settings.php
and add the user and password for the imported database. That config (user and password) is not dumped in the database so the colleague must have his/her own.