I'm developing a PHP application (PHP 7.3) for my company, which will be hosted in our own servers. For now it will only be accessible from within the network but eventually will be opened to the web.
The IT department is going to give me a "service" user whose password won't expire (so all the services for both the servers assigned to me and the app itself will keep on running forever) but they don't want that user's password to be stored in plain text anywhere in the server. To do that, the System Admin will have to input the password through a Remote Desktop Connection every time we need to make changes to the server services or such but I also need PHP to use that user's password constantly to access other resources on the network (LDAP server, other DBs, MS SQL DB and so on).
What I thought might work is:
- Having the password encrypted in a plain text file above the root folder of the PHP application
- Having a key in another plain text also above the root folder of my app but in a different folder
- Having a cypher in another file or maybe in my main configuration PHP file
Does this make sense? Or maybe I could also have the key encrypted and another key in a file to decrypt the first key?
I'm very new to encryption so any explanation or link will be very much appreciated.