Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

How would you protect a password file in a web site? Is hashing the individual passwords not enough? What other steps do I need to follow?

share|improve this question
2  
What do you mean by password file? For which set of users? A Salt is preferred over just hashing individual passwords. – SteveS Jan 23 '11 at 18:21
can't i use symmetric key cryptography to encrypt the file ? – user1184 Jan 23 '11 at 18:31
As @SteveSyfuhs asked, this question is not clear, and (apparently) contradictory. Are you referring to user passwords, or system passwords? What password file, since typically user passwords are stored either in DB or LDAP? If it's a password file - that would lead one to think of system passwords... but then, you could not hash it. So, which is it? – AviD♦ Jan 23 '11 at 18:53

1 Answer

up vote 3 down vote accepted

As Steve and Avi have asked, you are either referring to passwords for users of a website/web application or passwords for the system. Typical protection for the two options:

Passwords for web application / web site:

Stored in a database which is separated from the web DMZ by a firewall, not on the web server (which is in the web DMZ.) Access control is both on the firewall, and in encrypting the database or hashing the passwords in the database

System passwords:

Passwords hashed in /etc/passwd or /etc/shadow or SAM file or equivalent, and password file has access controls limiting access to root or system accounts only.

There are other options, but these are by far the most common.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.