How to hide password in configuration files

Question

Is there a way to hide my password for database access in my config.php configuration file ?

What is the best way to do this ?

I want to hide to visitors and hosting's admin :)

Answer 1

Found out its resolution you need to first create a secret in aws if your apache is running on ec2 instance. Then you need to check startup file of apache service. Add below lines to startup file and you will be able to use this variable anywhere in any apache config file -

SECRET_NAME="" SECRET_VALUE=$(aws secretsmanager get-secret-value --secret-id $SECRET_NAME --query SecretString --output text) NEW_PASSWORD=$(echo "$SECRET_VALUE" | jq -r '.password')

Set the environment variable for Apache

export SMARTONLINE_SITE_DB_PASS="$NEW_PASSWORD"

-> Now edit config files with below line SetEnv SMARTONLINE_SITE_DB_PASS "${SMARTONLINE_SITE_DB_PASS}"

and run sudo service apache2 restart

I hope this will help you resolving password masking issue on apache server. To check apache startup file you can run below command -

Answer 2

You can't generally hide them because at some point they have to be read by the application using it in run-time. The better bet is to keep them secure so they don't have a chance to be readable by anyone except you (or authorized personnel).

For example, your config.php should NOT be in a public or html directory that's web accessible. If I go to website.com/config.php, I should not see the file produced (even if it would typically be blank). This is because sometimes PHP code is exposed when a configuration setting is off, and this could reveal the code that sets the password you're trying to keep private.

Answer 3

You can hide the password from your sites visitors (see the other answers on that) but probably not from the servers administrators. They also probably have root access to any of your databases so they wouldn't even need the password.

The only way to really hide your sensitive data on a remote server is to rent a dedicated machine that you have root access to, store all data on that machine and use an encrypted file system.

Answer 4

password for database access. I want to hide to visitors and hosting's admin

You can't hide anything in a file from the hosting admin. Even if you use encryption, they can still find the key in your PHP source. If you don't trust your admin, get off the box.

Answer 5

It depends on what you are going to use the password for, a possible method would be to store a hash of your password rather than the password itself. When you then want to check if the password being used to login is correct, you just have to hash the password used to login and compare it to the stored hashed value.

However as edwin said that isn't possible if you are storing passwords for external services like databases. (In which case I would direct you towards Foxtrot's answer).