Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For applications to connect to the mysql database, often the credentials are stored in a properties file, like, for example jdbc.properties that have the username, password in cleartext.

Is there a very secure way of doing this ? Ofcourse, I can restrict access to this file, make it hidden etc. But are there alternate means to connect to a DB or ways to connect to a DB other than the properties file approach ?

One option is to store such sensitive information in another DB in an encrypted way. Then the application program can connect to this DB (using the properties file way) and then decrypt the sensitive information (instead of reading it from the properties file) and use it to initiate connection to the application DB.

Are there any other approaches ? Pls share your experiences and ideas. I am using Linux boxes to host mysql.

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

I think the basic question here is what you are trying to protect.
You could obviously make sure that your database server is very selective in what connections it accepts, which will provide protection for your data from access via other hosts.
You could ssl options to connect to the server (see the mysql manual for details).
You could encrypt the data in the properties file and use a decryption key hard-coded into the source of your application.

But ultimately, if somebody has access to the server where the application runs, then (s)he has access to your database.

share|improve this answer
    
Thanks wolfgangsz –  Sathya Aug 23 '10 at 5:24
add comment

If an application required access to the database, and instead it connected to another database for keys, authenticating with a properties file, where would be the increase in security? The chain is as strong as its link, and the link here is storing passwords in a properties file. You could nest such databases arbitrarily deeply, but at the end of it all the application has to have some method of authenticating against the nearest database in the chain. Hiding files isn't security as such; it's 'security by obfuscation', which isn't secure. You could (and should) make such that the owner and permissions of the properties file containing the passwords are set correctly, only allowing access to the application concerned. You could run the application as a different user, making the properties file visible only to that user. Also set up the permissions within the database itself to lock down the abilities of the user accessing the database, to minimise the impact of any security breach. The aim with setting up the permissions is: firstly, to stop any unauthorised access to the properties file and database; secondly, to minimise the effects of any such breach.

share|improve this answer
    
I see your point. Thanks for the input –  Sathya Aug 23 '10 at 5:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.