Setup: Say I'm properly generating a password hash (e.g., concatenating it with a /dev/urandom salt and a local secret and hashing it with bcrypt), now I go to store the result in a "user information" file containing name, username, email, salt, and hash result on Linux. Say I set proper permissions on the file to protect it, and that I generally take proper precautions to protect my server from attackers/intruders.
Question: Is it important that I do anything else to secure the file itself? Is plaintext encoding fine or should another encoding be used to attempt to obfuscate it? Should it be encrypted, and a password required to decrypt it?
Update from comments:
- There was a good (at least partial) answer that hashed passwords should be stored in protected areas of the network instead of DMZ whenever possible.
- Also the local secret should be stored separately from the hash file, so that an attacker that got one wouldn't automatically get both. An HSM (Hardware Security Module) was recommended.
- The point was made that a file may be vulnerable to a URL-escaping attack, unlike a database.
- Not in a comment, but I also found this related thread helpful, the additional relevant advice seemed to be to make sure to store the file in a secure location and to err on the side of encrypting it.
