How would you protect a password file in a web site? Is hashing the individual passwords not enough? What other steps do I need to follow?

  • 2
    What do you mean by password file? For which set of users? A Salt is preferred over just hashing individual passwords. – Steve Jan 23 '11 at 18:21
  • can't i use symmetric key cryptography to encrypt the file ? – user1184 Jan 23 '11 at 18:31
  • As @SteveSyfuhs asked, this question is not clear, and (apparently) contradictory. Are you referring to user passwords, or system passwords? What password file, since typically user passwords are stored either in DB or LDAP? If it's a password file - that would lead one to think of system passwords... but then, you could not hash it. So, which is it? – AviD Jan 23 '11 at 18:53

As Steve and Avi have asked, you are either referring to passwords for users of a website/web application or passwords for the system. Typical protection for the two options:

Passwords for web application / web site:

Stored in a database which is separated from the web DMZ by a firewall, not on the web server (which is in the web DMZ.) Access control is both on the firewall, and in encrypting the database or hashing the passwords in the database

System passwords:

Passwords hashed in /etc/passwd or /etc/shadow or SAM file or equivalent, and password file has access controls limiting access to root or system accounts only.

There are other options, but these are by far the most common.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.