Looking at some old classic ASP sites which could do with a bit of tightening up. The SQL server database connection string has the password in clear text within an include file on the server. Obviously this is nasty as anyone with access to the server or the source code can gain immediate access to the database (if they have firewall access etc).

I'm assuming that there is a recommendation on how to do this more securely (even a DSN would be better I guess?)

Any suggestions welcomed - hopefully not a load of "what year are we living in comments" ;-)

  • 1
    Basically, you shift it to a difficult to access file. I'm sure someone will come along with specific details, but it is one of the times when a plain text password is needed at some point. Can't connect to the db without the password, and no point in encrypting it, since wouldn't be able to connect without decrypting first, which would require a password, and so on! – Matthew Oct 29 '15 at 9:52
  • OK that's what's been done I think... is a DSN no more secure? – Steve Oct 29 '15 at 12:04

You should do it the same way you do everywhere else: use env vars.

Set O/S env var for user foo. Run application as user foo. Only foo or root can read that env var. Root can always read everything, including files.

Env vars are better than files as they are safer by default (ever screwed up a file permission?) and prevent you from accidentally checking passwords into source control, because you can't.

See https://stackoverflow.com/questions/6360036/getting-environment-variables-in-classic-asp

If you're opening child processes, pass them a clean environment.

| improve this answer | |
  • Sorry I don't see how that can be done. The application needs to connect to the database with a password are you suggesting I somehow have a login session and leave it open for the application to use? – Steve Oct 29 '15 at 17:23
  • Nope. Suggesting that you store the db password in an o/s environment variable, read it on startup (same as you would a file), and use that in your db connection string. You could use an external file too, but env vars are a more general solution (esp for open source projects). The best you can do is control access to the password. Encrypting it won't help, as your app needs access to the key anyway. HSM protects the key, but can still be used by root – Neil McGuigan Oct 29 '15 at 19:27
  • Can you point me to somewhere that explains how to do this... I don't understand how it can be done. – Steve Oct 31 '15 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.