CODEWITHSUNDEEP
securitypasswordspassword-encryptionpassword-hash
Eric Belair
Eric Belair

Reputation: 10702

How should I store a known/hard-coded password in the database?

I have a web app that uses known username and password combinations to login to external servers. There are multiple username/password combinations used for different services. Right now, they are essentially "hard-coded" into the website code, but, I would like to move this information off the code base for better security.

My initial thought is to store this data in the database which is used to support the website. I want to store it in a way that it is not easily "hackable" (i.e. I'm not going to store it as plain text or as a MD5 hash). Should I follow the same format that I use to store the website user's passwords, where I use a random number generator to create SALT for each password and then store the password as hashed combination of the password and SALT, or would this be overkill?

Upvotes: 0

Views: 2333

Answers (2)

Eric Belair
Eric Belair

Reputation: 10702

After more research, I've decided at this point to follow the ideas here:

Encrypt a Column of Data - SQL Server | Microsoft Docs

...and encrypt/decrypt on the DB inside a Stored Procedure.

Upvotes: 0

Ameen Ali Shaikh
Ameen Ali Shaikh

Reputation: 429

Generally, storing passwords in the application code is always a bad idea. Moving it outside the code has many advantages including security.

Now storing it either in DB or Configuration Files is a choice you have to take depending on your application.

For full security you should never store passwords in retrievable form. But to login to a external server as in your case, you need to get the actual plain text password, so one way hash will not work for you.

In our product we deal with such situation by using 2 Way SSL Certificates. It is very secure and there is no need to store the passwords.

But if you really need to store the passwords, then I will suggest to use configuration file and let your application read it. You can encrypt the passwords stored in the configuration files (Encrypting the passwords stored in the configuration file will again bring you back to the same question of how to protect the key). The access to the configuration file should be restricted (in Unix, 600 File Permission).

Alternatively, if your web application is Java, then you can consider using JNDI.

Upvotes: 0

Related Questions