TL;DR :: OP should use Kerberos or PAM or some other pluggable authentication method on the MySQL end.

I think the discussion is about the particular case in the thread. It's absolutely true that the authentication system should have one-way hashed passwords. However, the OP appears to be wanting to store actual decryptable, non-hashed credentials used to connect to another system.

Now there are reasons this is a bad idea, and that's what people are asserting. In the OP's case, something needs to decrypt these passwords to achieve what OP is trying to do. Therefore anyone who can access these non-hashed encrypted passwords is likely to also have access to the decryption routine, rendering encryption mostly moot. That's why it's a bad idea.

There are ways to set up a password vault that addresses some of these concerns, but anything that must run from cron is going to have a weak link in security somewhere. The cron system would need access to the vault in this case, so it's still basically plaintext passwords. The only real fix is to use something like public key cryptography.

Thankfully, database software tends to have lots of ways to authenticate. MySQL has pluggable authentication which support Kerberos, PAM, etc. Postgres has its own auth methods including GSSAPI with Kerberos.

Since this is running under cron, there's still going to be a bit of a weak link in that some likely unmanned and unwatched user account will house the private keys, but it's still a lot better than depending on plaintext passwords on disk.

Edit: changed version-specific URL to track current version for Postgresql after a suggestion from erix

In reply to Re: encrypt passwords by mr_mischief
in thread encrypt passwords by fionbarr

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.