Am I in this particular case allowed, to store password in java program?

Question

I have a Java-Server program running on Ubuntu-Server which gets every 5 minutes current location data of my android-smartphone (which I carry with me). My architecture is the following: My smartphone connects to the server using tlsv1.2 and transmits the gps location. After receiving the data, the server-program establishes a connection to a local mysql-database inserting the location,time and so on.

I read this answer from William Brandl and i thought, yeah, but this does not increase my security level.

I am the only one who have physical access to my machine. So my java-program can only be reverse engineerd if my server got compromised. Storing the username and password into a seperate file makes absolutely no sense to me in this particular situation. The program is running under a low privileged user. So if my user or my server got compromised, someone can as easily reverse engineer my program getting to the honey(username and password) as just open the file containing the username and passwords which is readable by the same user.

Is in this particular case storing username and password in a separate file just more workload? Is there a more secure way regarding this case of storing the sensitive data?

Bear with me if this is the wrong place to ask.

Answer 1

I would store the password only in memory at runtime, but this has one drawback. You need to type in the password every time you start/restart the server. This is the most secure way to managed plaintext passwords.

Plus I would followed the advice to r00t, create two users on the MySQL server, one with read permission and one with write permission. Just in case someone was able to gain access to your server and dump the memory.

Answer 2

I would recommend you to create two mysql users and have the one with only write access stored in the java-program.

For you, use the second one with read access.

If you server get compromised, the attacker won't be able to read your locations, just insert false ones.

--Edit--

To answer if you can sotre your credential in your code :

It's does not improve or degrade the credentials security but, it gets your hability to modify it harder. In fact, you will need to recompile your java code.

The good practice says the credentials should be in a file for this reason. In case of password disclosure, your response time will be higher.

Answer 3

To start out: I agree with you that William Brandl's piece leans more towards convenience rather than security. I might even go as far as saying that he is wrong when saying that storing the credentials in a file is the only way to go. Atleast when he leaves out any part regarding encryption. The link he provides to the CWE-259 article even specifically says that:

Username and password information should not be included in a configuration file or a properties file in plaintext as this will allow anyone who can read the file access to the resource. If possible, encrypt this information and avoid CWE-260 and CWE-13.

The fact is, no matter what you decided to do, an attacker with access to your files will be able to steal your credentials.

---

Since you are running the server with a low privileged user, with restricted access and a strong password, you're generally pretty safe. As long as you lock down all the users, give your database user only the minimum privileges required, etc. you probably won't get into any trouble.

Separate file

You might want to consider storing the credentials in a separate file, just for your own convenience. That's because you can then easily swap in and out new credentials if you ever choose to change up the database. This way, you don't have to recompile your source.

You could also encrypt the credentials stored in that separate file. This will require your code to decrypt the key however, meaning that the decryption-key is in the compiled Java files. This is really just security through obscurity (e.g. a false sense of security), and honestly doesn't add much. It will however increase the difficulty a little, instead of just a plaintext username and password.

Start-up

The only thing I can suggest to make it more secure, avoiding hardcoding and storing the credentials in a separate file, is to provide the credentials at startup. This will be more cumbersome from a technical perspective (e.g. you will have to manually restart the server every time it goes down), but will at least remove all the problems regarding where to store the credentials.

However, the credentials will be stored in memory. So if an attacker really wants to get the credentials, a memory dump might be all it takes, regardless of where you store the credentials.

Summary

I say, for your own convenience, store the credentials in a file, but don't be afraid if you feel like keeping the credentials in the source code. (Just watch out for programmers reviewing your code, as it's bad practice ;-) ). Again, just make sure to monitor your server, make sure you apply a least-privilege-kind of policy on your users and services, and make sure all credentials are unique and strong.

Note:

For future readers; This isn't to say that you shouldn't care about how you do credentials management. A lot of frameworks and languages provide ways to encrypt and secure your credentials, and following best practices is always encouraged. But the fact of the matter is that if someone has access to your files, you are generally out of luck. So protect your files!