3

I am trying to build a NMS (network management system) and I am required to store passwords for 3rd party databases, devices and servers that are being managed (not user passwords). These passwords need to be able to be retrieved as plain text in order to login to the devices, connect to the remote databases.

I would like to know the best practices for storing such passwords either in a database or a text file. My current approach is that, store the password as base64 encoded in a text config file and decode it in the source code. Only the developers have read/write access to the config file and source code. No other users on the dev/prod server can read these files. Do you think this is a safe approach?

And yes, I have this answer, but in my particular case, I am not dealing with user account passwords, but instead I am dealing with passwords for logging into the devices that are being managed. True, if someone gets hold of such passwords, they can easily login to the box and "reload/reboot".

Also, because the NMS is all about automation (and assuming I will be running multiple cronjobs), I cannot expect the NMS tool to be prompted for passwords.

Thanks, Amit

Improve this question

1 Answer 1

Reset to default
2

Never. Ever. Use. Base. 64. Encoding. It is not secure. It is also not allowed if you are managing other peoples passwords.

You must store the passwords encrypted through a machine level program that will encrypt and decrypt them. After they have been encrypted you can store them where you like, but you must always go through the program to encrypt and decrypt them.

Roboform Enterprise is a great password manager. The security official can change the roboform password for the clients, generate random passwords, and keep things pretty darned secure.

Of course since you're building your own, the truth of the matter is that you will have to build an auto key rotating encryption program with the keys stored in a separate physical, non network, secure location. You then encrypt the passwords and store them.

When a key gets rotated, the program retrieves every password, decrypts, encrypts with the new key, and restores them to the database or does it on the fly with the next retrieval. But basically you have to have a system level program do it.

You should also make this dependent on the system it is compiled on. This way you can make sure that if the program itself is taken to a new system, it won't work decrypt those passwords correctly.

Of course this means that for every client on your system, they need their own copy of the application, and their own set of keys. That however is the nature of enterprise security.

Improve this answer
5
  • 2
    To complement what Robert said, be sure you don't store the keys inside the code. The problem is that when you use two-way encryption, anyone with access to the code will know how to decrypt the passwords (not good). So, its better to keep those keys in a separate place. I will also recommend you to encrypt your database credentials. Use different keys for different things (don't recycle them) and rotate them. Even though some people may disagree, I would suggest to combine a well-known encryption algorithm with something of your own (like a closed-source obfuscation algorithm).
    – lepe
    Oct 9, 2015 at 1:11
  • thank you for the feedback. really appreciate it. In regards to a cronjob that will run a script every night on a server which has the database and source code, where would you recommend storing the keys? - in a separate ftp server to which cronjob/script can fetch all the keys from?
    – amulllb
    Oct 9, 2015 at 15:41
  • SFTP. FTP is something that should be avoided for in house usage.
    – Robert Mennell
    Oct 9, 2015 at 16:02
  • 1
    "It is also not allowed if you are managing other peoples passwords" - Not allowed by whom?
    – aroth
    Apr 19, 2016 at 6:59
  • SB1386, PIPEDA, DPA, PIPL are all laws from varying countries REQUIRING the encryption of passwords in databases.
    – Robert Mennell
    Apr 19, 2016 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .