I am configuring an application server hosted on EC2 instance to send e-mail notifications.

This requires configuring SMTP settings and storing them, including password, in a config file:

gitlab_rails['smtp_address'] = "mail.example.com"
gitlab_rails['smtp_port'] = 587
gitlab_rails['smtp_user_name'] = "[email protected]"
gitlab_rails['smtp_password'] = 'password'
gitlab_rails['smtp_domain'] = "mail.example.com"

Is storing plaintext password really bad? If an attacker gets inside they can do some damage anyway. Still I'd like to make it as secure as possible so I am wondering what's the best approach and best practice.

  • Hashing the password would be smart, but you need the full connection string password for the connection... Jun 29, 2022 at 16:18
  • Thanks @SirMuffington, turns out this particular application - Gitlab - can read settings for certain features from encrypted config files. Should be easy to set up.
    – Seb_
    Jun 29, 2022 at 17:00

1 Answer 1


Is storing plaintext password really bad?

As always answers to such questions in the context of security is - it depends on the treat model.

Regarding the credentials - based on the excerpt of the config file you provided it appears that you are configuring a Gitlab server. The Gitlab allows using the encrypted SMTP credentials as described in the documentation:

Instead of storing the SMTP credentials in the configuration files as plain text, you can optionally use an encrypted file for the SMTP credentials. To use this feature, you first need to enable GitLab encrypted configuration.

The encrypted configuration for SMTP exists in an encrypted YAML file. By default the file will be created at /var/opt/gitlab/gitlab-rails/shared/encrypted_configuration/smtp.yaml.enc. This location is configurable in the GitLab configuration.

The unencrypted contents of the file should be a subset of the settings from your smtp_*' settings in the gitlab_rails configuration block.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .