#HARDCODED PASSWORD HOW TO#
#HARDCODED PASSWORD INSTALL#
#HARDCODED PASSWORD PASSWORD#

It is one thing to put protection in place. don't overlook the importance of auditing and log analysis.

#HARDCODED PASSWORD INSTALL#

Knowing and understanding where your threats are will determine which techniques and facilities are best suited and whether the default facilities are enough or whether you need to turn things up a notch and install additional precautions.

Understand and use the tools available - ssh, sudo, chroot etc. Define appropriate policies to restrict access to only what is absolutely necessary. For example, Linux uses SELinux or AppArmor (I think ubuntu is based on apparmor). Use the additional hardening features of your OS. Use the facilities available to restrict access. Get to understand permissions, uses and groups. This has the advantage of making it easier to change your passwords as you don't need to edit your sources and you can have multiple scripts use the same source, allowing you to change passwords in just one place. Put them in a separate file/location and have your script use the info. In generalĭon't hard coded authentication credentials. You need to understand the risks most relevant to your situation to assess what actions are most suitable.

#HARDCODED PASSWORD HOW TO#

While it is right to be concerned about scripts with hard coded authentication credentials, the real question is how to manage authentication credentials used by automated scripts and more importantly, what are the highest threats or risks associated with the system. Perhaps you are asking the wrong question. Additionally if someone can sudo and beat your own privileges (like the host that runs the box), then the key hashing is really the only option to prevent the admin user from getting into the database.Īdditionally you would need to disable the root account on the database since this would allow the attacker to read the database tables anyhow.

#HARDCODED PASSWORD PASSWORD#

Obviously there would be no point if you were storing both keys on the same system unless of course you were storing the private key with higher privileges than the public key.Ībout the permissions, if someone has access to your system and it's this much of a concern for a password to be stored on the box in a 'readable format' it sounds like there are deeper issues with the configuration of permissions on the box itself. Since you're worried about someone gaining access to the original password that exists in the code, the attacker would have to listen for the private key from the user triggering the script (which could happen via SSH on a cron on a separate machine). This post on Comodo actually explains the keys a little better.

You can limit access to this user to the times you would expect the backups to run. This would prevent someone from creating tables, dumping tables, and replacing contents. You should also protect the script using directory and file permissions.Īdditionally, (depending on the database) you should be able to create a user account for the database that has back-up privileges only. This should obfuscate the password from casual passers by, as they would only have the public portion of the key known to them. You can create public/private key pairs and encrypt the password.

Hardcoded password