What is best secure way to store passwords in Java web application?
I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect DB credentials even if my VM with web application get compromised.
What are my options? If to store it encrypted, where/how should I store encryption keys?
The best way to store Passwords in Java applications , if you are running it on Windows bases systems is to use DPAPI from Microsoft, which uses the user's windows creds to encrypt the passwords. http://msdn.microsoft.com/en-us/library/ms995355.aspx.
There is also a Java wrapper for your convenience http://jdpapi.sourceforge.net/
Since Windows will manage your keys, you don't have to manage keys yourself. In Java, never think about writing your own mechanism to manage keys and store passwords. It is simply not secure because, any one having access to your .jar file can easily reverse engineer to the source code files and obtain your mechanism. CryptProtectData() is the way to go
Split your Java application into two parts. Front-end, dealing with HTTP requests and back-end, dealing with database. They communicate with each other over a simple API (IPC). Therefore, database credentials stay in the back-end application and remain secure even if front-end application gets compromised. Make sure each application runs under it's own user and that they cannot access each other's files. If you are using Linux, I recommend using MAC like SELinux, TOMOYO, AppArmor to isolate the applications. Alternatively, you can run each application inside it's own VM or even physical machine, but that would be a waste of resources.
https://en.wikipedia.org/wiki/Inter-process_communication
https://stackoverflow.com/questions/830641/is-it-possible-to-have-interprocess-communication-in-java
