I was working on a small hobby project of mine, a blog-CMS-something-thingy which uses PHP and MySQL, and I just came to think about the issues of keeping your SQL password from prying eyes, more specifically in UNIX environments. The web PHP interpreter obviously needs to be able to read it, but on, for example, a shared hosting setup, you don't want just anybody to be able to read it. Now, this sounds simple at first. Simply stick the login credentials in separate config file to be included by all other PHP scripts that need database connectivity, change the file group ownership to the web server's group, set the permissions to 0640 and you're set. However, this only works if you have root permissions, since you can't assign the file group ownership to a group where you aren't a member, and if you so happen to be a member of the web server group (which is very unlikely), there's a fair chance that any other user on the same machine is too. I guess you could just set the file group ownership to the 'users' group and use permissions like 0604, which would protect the file from all other members of the 'users' group (but not from, say, breaches in other services or users who aren't members of 'users'), but this seems a bit hackish and some systems don't have a common group for all users. Perhaps this should have gone in the UNIX forum, but I wanted to hear about how you protect SQL passwords in PHP code. How do you people do it? Am I missing something really obvious and doing something really retarded here?

One option is of course to not use shared hosting.

Another is to enable base_opendir or whatever other restrictions exist in PHP - these are clumsy and there are potential ways around them, so it's not guaranteed.

One way which is quite nice is to have the database login / password passed in environment variables from the web server. This is straightforward to set up and means that other users can't read them at all, even with read access to your files (beware though: if they can gain write access, they can get them).

Create a per-virtual host configuration for Apache (make sure this file is not readable to any of the users) which sets the password in an environment variable (with SetEnv)

There are still ways; it is possible (but nontrivial) to read the contents of a process's memory out of /proc - where the passwords will be if you know how to find them. A shared hosting user can create a script to open a file in this directory and read it.

Cheers

Mark

Quote:Original post by markr
One option is of course to not use shared hosting.

Another is to enable base_opendir or whatever other restrictions exist in PHP - these are clumsy and there are potential ways around them, so it's not guaranteed.

One way which is quite nice is to have the database login / password passed in environment variables from the web server. This is straightforward to set up and means that other users can't read them at all, even with read access to your files (beware though: if they can gain write access, they can get them).

Create a per-virtual host configuration for Apache (make sure this file is not readable to any of the users) which sets the password in an environment variable (with SetEnv)

There are still ways; it is possible (but nontrivial) to read the contents of a process's memory out of /proc - where the passwords will be if you know how to find them. A shared hosting user can create a script to open a file in this directory and read it.

Cheers

Mark

That's pretty nifty. Seems a bit heavy to setup though.

Quote:Original post by ToohrVyk
Place secret file on server under your ownership. Execute a PHP script which creates a copy of that file under the sole ownership of the web server, and sets the most paranoid permissions possible (read-only, non-executable). Remove the original secret file.

That's so simple I don't know why I didn't think of that myself. Thanks for showing me the light.