CODEWITHSUNDEEP
linuxsecurityauthentication
user290043
user290043

Reputation:

How can we store password other than plain text?

I've found numerous posts on stackoverflow on how to store user passwords. However, I need to know what is the best way to store a password that my application needs to communicate with another application via the web? Currently, our web app needs to transmit data to a remote website. To upload the data, our web app reads the password from a text file and creates the header with payloads and submits via https.

This password in plain text on the file system is the issue. Is there any way to store the password more securely?

This is a linux os and the application is written in python and is not compiled.

Further clarification: There are no users involved in this process at all. The password stored in the file system is used by the other web app to authenticate the web app that is making the request. To put it in the words of a commenter below: "In this case, the application is the client to another remote application."

Upvotes: 26

Views: 35183

Answers (6)

Max
Max

Reputation: 1

Protecting the Automatic Logon Password

The LsaStorePrivateData function can be used by server applications to store client and machine passwords.

Windows only

Upvotes: -3

Neal
Neal

Reputation: 4397

From the question it seems you need to store password in such a way, that it can be read and used in an automated transaction with another site. You could encrypt the password and store it encrypted in the file, then decrypt it using a key stored elsewhere in your system before using it. This makes difficulties to someone that gets access to the file from using the password, as they now have to find the key and encryption algorithm used, so they can decrypt it.

As defense, more lesser defense is always better than one strong defense that fails when breached. Moreover, I would also secure the file containing the password, rather than the password itself. Configure your webserver to disable possibility to serve the file containing the password, and try to set the process needing the file to run under a separate account, so you can restrict the access to the file to account running the process and admin accounts only.

Upvotes: 6

Ray
Ray

Reputation: 21905

I don't think you will find a foolproof way to do this. I would suggest a combination of things to achieve 'security by obscurity':

  • store the password file on a different computer than the one which will use it
  • store the file path in a separate config file on the app nachine
  • use permissions to limit access to the config and password files to your process only
  • audit file access if your system allows it (keep a log of who touched the files)
  • give the folders and files innocuous names (/usr/joe/kittens.txt?)
  • block physical access to the computer(s) (offsite hosting, or locked closet, or something)

Upvotes: 4

Glenn
Glenn

Reputation: 1167

Is your web application hosted on a farm? If not then a technology such as DPAPI will allow you to encrypt the password so that it can only be decrypted on the machine it was encrypted on.

From memory there can be problems with using it on a web farm though, as you need to go and re-encrypt the value for each server.

If it is a web farm then you probably want to use some form of RSA encryption as has been suggested in other answers.

EDIT: DPAPI is only good if you are hosting on windows of course...

Upvotes: -3

Jared Forsyth
Jared Forsyth

Reputation: 13162

At the very least you should use permissions (if you are on a filesystem which supports them) to ensure that you are the only one able to read the file.

In addition, if your app is compiled, it would not be too difficult to encrypt the password with a hard-coded passphrase. If the code is not compiled this method wouldn't really be helpful, as a would-be attacker could just read the source and determine the encryption.

Upvotes: 0

Ming-Tang
Ming-Tang

Reputation: 17651

You can use a two-way key encryption algorithms like RSA, The password is stored encrypted (by a key, which is stored in the user's brain) on the filesystem, but to decode the password, the user must enter the key.

Upvotes: 0

Related Questions