Re: Permissions for index.php -- hide MySQL password?

On Monday, December 22, 2003, at 12:10  pm, Reini Urban wrote:

> Robert Dodier schrieb:
> > I have a question about the MySQL password. I see that I
> > can put the admin password in index.php in encrypted form --
> > that's great. But can I also encrypt the MySQL password?
>
> that's unfortunately a mysql architectural problem. their fault.
> every perl and php programmer must deal with that solution somehow.
>
> one can read in a local file with the password, which is not in
> the web docroot, but it must be passed cleartext to the database.
> since php's are normally associated with the php engine, and no one 
> local access to the webserver (shell or ftp account), it's quite 
> secure.
>
> for important mysql passwords in php apps, one stores the passwords in 
> a secure location. but it must be readable by the apache user, so 
> anyone with problematic/erratic php script (there are thousands, I 
> worked for a very large ISP) will be able to read it, if he knows 
> where.
>
> > It seems like a security problem, since index.php must be
> > readable by the web server; it might be possible for anyone
> > with a login on the project servers to read the MySQL password.
> > I've read through archives for PHP, MySQL, and PhpWiki, but
> > there doesn't seem to be a definitive solution. It seems the
> > standard operating procedure is to ask the SF sysadmins to
> > "chgrp nobody index.php". Is there another way?
> > It may be not so much of an issue, since by design, a wiki
> > is pretty much wide open for abuse anyway. But it seems
> > like the MySQL-password-in-a-script problem must be generic to many 
> > SF projects that use MySQL.
>
> yes, see above.
>
> > How was this problem solved for the PhpWiki project
> > demonstration wiki?
>
> password stored plaintext in index.php.
> no one without shell account is able to see the content of index.php.
> --
> Reini Urban
> http://xarch.tu-graz.ac.at/home/rurban/

Hi,

I agree with Reini, normally it's not a security issue because usually 
no one has access to the index.php file anyway.

As far as I know, most web-hosts/providers do not even allow direct 
MySQL access from outside their domain anyway, probably only within 
their own localhost(webserver) via php, and not from any external IP 
address.

However, if anyone does figure out how to use an encrypted database 
password in PhpWiki's index.php, I'm sure such a modification would be 
welcome.

Carsten



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click