I'm in process of creating a tiny blog platform and I've encountered a pretty controversial topic of storing connection string to a DB securely on a host. Here is a reference question: How to encrypt database connection credentials on a web server?.
As of my question: I thought of storing credentials in gpg-encrypted file somewhere in
/etc folder of Ubuntu 14.04 host. Whenever server starts it would prompt a sysadmin (me) to decrypt a file and then there is need of a service that would run in a background waiting for a site back-end to query it for a connection string. Then it would return all the necessary for DB connection information and back-end would proceed with querying a DB itself.
IMO with this approach the only place where a password is stored on up-and-running server is RAM. Whenever server crashes because of malicious attack or attackers managed to dump web root they still can't get the password as password granting service works on a system level.
Is it a good security scheme? What alternatives would you propose (Python Flask, MySQL and peewee)? Also if my idea is not that bad how can I implement that "service" to run in a background and wait for a credentials query (preferably some kind of a bash script)?
Thanks in advance!