Secure database password stored in an env variable

Question

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other sensitive info are stored as environment variables in plain text on the production machine.

Looking a little bit around I saw that most of the solutions are about limiting the access to these kinds of sensitive data (by storing them on a file with access granted only to the admin of the system), and to the access to the DB itself (by limiting the access only to fixed IPs).
Unfortunately none of them is possible in this case for a few reasons: the service that hosts the system DOES NOT allow us to have a IP (so I can not set the DB to be accessible only by one IP) and the DB credentials must remain in an environment variable for deployment reasons.

On the other hand, the DB is not actually containing sensitive data and, more in general, at the moment we are mostly worried about not having internal persons going through the production DB and causing damage, rather than external hacker attacks.

So my question is: what would be a "fairly safe solution" in this case?

Would it be a safe solution to encrypt the password for the DB and then store the decryption key on a config file uploaded on GitHub encrypted with this procedure (although it looks a little bit outdated)?

I thought this was a quite straight-forward and popular topic but apparently I was wrong, since looks like there are not many 'TODO-list' like answers.

Answer 1

Assuming you run the web server as its own user, then only root and that user can read your OS Environment Variable†. Unless you're using 30 year old AIX or something. Even Windows protects envvars.

If you encrypt the values, how are you going to secure the key‡? The key could be read by the user or root too.

If you store the values in a file, how is that safer than an envvar? It isn't. An envvar is safer in that you won't accidentally put the passwords in source control.

† This does not apply to command line options!
‡ You're going to buy an HSM, that's how. The HSM can still be used by root or user

Answer 2

You want to have a method to store and distribute secret information in a secure manner. One possible solution would be Vault: http://vaultproject.io/

I'm not sure what you mean when you say "and the DB credentials must remain in an environment variable for deployment reasons", but you might want to reconsider that assumption. If it turns out that that actually is the case, you can still use something like Vault to load the DB password into the environment variable at runtime, so that it doesn't ever live unencrypted on disk. But definitely consider not storing it in an enviroment variable at all, or at least not a global one.