in reply to encrypt passwords

Some more details might be helpful...

«The Crux of the Biscuit is the Apostrophe»

Replies are listed 'Best First'.
Re^2: encrypt passwords
by fionbarr (Friar) on Apr 17, 2015 at 13:24 UTC
    I have a list of hashes: 
    @LoH = (
                {
                     database        => 'PQxxxxLD',
                     hostname        => 'wpx0z051xsi.xxxx.com',
                     servicename     => 'pqospxxxbld.xxxx.com',
                     port            => '9010',
                     username        => 'username',
                     password        => 'password',
             }    env             => 'prod',
    )

    [download]
    This data is stored in a Perl module. There will be perhaps 100 databases. The program is run vi a cron file and there is no user action so the vulnerablity is only through the info stored in the program code. I'm thinking of having two columns in a protected table where one column is the plain-text key and the other column is the actual password
[reply]
[d/l]
      I don't think it is a good idea to store the passwords in a Perl module, unless you can be very sure that only authorized people can get access to this module. And if you are certain no "black hats" can have ever have access then encrypting the passwords does not serve any additional purpose.

      Personally I think it is more secure to store the passwords in a separate data-base with access to this database only granted to the particular cron-process that runs your script(s).

      CountZero

      A program should be light and agile, its subroutines connected like a string of pearls. The spirit and intent of the program should be retained throughout. There should be neither too little or too much, neither needless loops nor useless variables, neither lack of structure nor overwhelming rigidity." - The Tao of Programming, 4.1 - Geoffrey James

      My blog: Imperial Deltronics
[reply]

        An alternative that's maybe a little simpler depending on the use case is to store them in a local file that only the process that needs them has read permissions for. It's probably still worth putting some encryption on it to prevent accidental viewing in case permissions get messed up, but it will be useless against an actual attacker, who would probably get access to the perl code, too.

[reply]

In Section Seekers of Perl Wisdom