2

I'm in process of creating a tiny blog platform and I've encountered a pretty controversial topic of storing connection string to a DB securely on a host. Here is a reference question: How to encrypt database connection credentials on a web server?.

As of my question: I thought of storing credentials in gpg-encrypted file somewhere in /etc folder of Ubuntu 14.04 host. Whenever server starts it would prompt a sysadmin (me) to decrypt a file and then there is need of a service that would run in a background waiting for a site back-end to query it for a connection string. Then it would return all the necessary for DB connection information and back-end would proceed with querying a DB itself.

IMO with this approach the only place where a password is stored on up-and-running server is RAM. Whenever server crashes because of malicious attack or attackers managed to dump web root they still can't get the password as password granting service works on a system level.

Is it a good security scheme? What alternatives would you propose (Python Flask, MySQL and peewee)? Also if my idea is not that bad how can I implement that "service" to run in a background and wait for a credentials query (preferably some kind of a bash script)?

Thanks in advance!

Improve this question

1 Answer 1

Reset to default
2

Is it a good security scheme?

Yes, it is reasonable. Usually people don't do this because they want automated systems, and the downtime caused by needing to manually enter a password every time the app restarts is beyond what they'd consider acceptable.

What alternatives would you propose (Python Flask, MySQL and peewee)?

Basically all the things mentioned in the question you linked to. Personally, I'm a fan of Vault, which is a separate HTTP server that stores your secrets. It's not at all a perfect solution: you still have to authenticate to it, which practically means you end up with a temporary session token that you store in plaintext on your server.

Also if my idea is not that bad how can I implement that "service" to run in a background and wait for a credentials query (preferably some kind of a bash script)?

With programming? You're probably going to want to just do this in your application code as part of its startup process.

Improve this answer
2
  • Thanks for the Vault link - it's an interesting thing to investigate. As of implementation, I'm interested in how to make running bash script -> process to accept requests and answer (just like a web server) locally.
    – ddnomad
    Feb 11, 2017 at 19:43
  • 1
    As you say, it's just like any web service. Bash is probably the wrong choice there, but you can find people writing web servers in bash.
    – Xiong Chiamiov
    Feb 11, 2017 at 22:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .