security: encrypt config.inc.php database info

Hi,

I was wondering if it’s safe to have config.inc.php stored as a clear text file. Is it possible to encrypt the whole file or at least the database connection info?

Anyway, is it really safe to have this file stored as clear text? Is it enough to have it as "read only" ?

Your help will be appreciated.

Thanks.

Mc

Well, in the three years (or more? I’m losing track of time here) the only time it’s been bothered is when somebody left it world-writable.

Quote from: sottwell at Sep 23, 2008, 10:07 AM

Well, in the three years (or more? I’m losing track of time here) the only time it’s been bothered is when somebody left it world-writable.

Susan,

Thanks for your quick reply.

Well, I’m about to install modx for a client’s intranet, and they detected that config.inc.php is stored in plain text, and they were inmediately surprised and asked me to find a way to store this file encrypted. If this is definitely not possible, are there any arguments that support why the current configuration is safe "as it is" ?

Regards.

There are others who should be better able to address that than I; I’m an "if it works don’t break it" kind of person

To play devil’s advocate to your question --

In its default location/permissions, if someone can remotely access that file, you have MUCH bigger issues than someone accessing your CMS at that point. On top of which, encrypting the file is not a trivial manner, because the question then becomes, where and how do you securely store the decryption key so that it’s safer than the plain text file to start with?

I do think there a valid issue here though. Maybe it would make sense to store the passwords in an crypt() format with the key being elsewhere. That wouldn’t prevent a determined hacker, but it’d certainly avoid the person casually looking through files on your web server.

an alternative would be to store your db credentials in another file, store it outside the web root, and then include it in the config file.

one problem with using encryption is that decryption can be quite cpu intensive depending on the algorithm used, so unless there’s a vulnerability (obviously this is what you’re trying to defend against), you’re just wasting cpu cycles. this can have a big impact if the site is under high load.

storing the credentials outside the web root is a compromise, adding a bit of extra security without the overhead of decryption.

But as vbrilon mentioned, if you’ve got somebody wandering around in your files, you’ve got much bigger problems. As long as you don’t have the config file world-readable, they can’t even read it unless they have your login or root. I have my files set to be owner and group read/write, and assigned the Apache user to my group. Now nobody can get access as the Apache user; it doesn’t really have a login and certainly has no shell. So if somebody gets in as me or as root, the my server is dead meat anyway. If you’re using suexec, you don’t even need to have the Apache user in the equation.

Quote from: sottwell at Sep 24, 2008, 07:12 AM

But as vbrilon mentioned, if you’ve got somebody wandering around in your files, you’ve got much bigger problems. As long as you don’t have the config file world-readable, they can’t even read it unless they have your login or root. I have my files set to be owner and group read/write, and assigned the Apache user to my group. Now nobody can get access as the Apache user; it doesn’t really have a login and certainly has no shell. So if somebody gets in as me or as root, the my server is dead meat anyway. If you’re using suexec, you don’t even need to have the Apache user in the equation.

Thanks for all the comments.

If Modx can read the config file, then how do we know others won’t read it?

Quote from: mcclausky at Sep 30, 2008, 09:34 AM

Thanks for all the comments.

If Modx can read the config file, then how do we know others won’t read it?

The only way to make use of the config file outside of your own user account is if someone on the same box can include your config file using a local file path (using a URL will do nothing but execute the file on the remote server and return any results, but since config.inc.php doesn’t return anything, there is nothing to worry about on this). Make sure your shared hosting provider does not allow users to include files outside of their own directories or this could indeed be an issue.

Just a point here on ’shared hosting providers’, any admin of these servers can see anybody’s config file if they want to, they can also completely trash your MYSQL database if they want to and delete all your files, encryption wont help here, you just have to trust them<paranoia>whoever they are!</paranoia>