Encrypt password.

[devendrap]

How to encrypt database password in the perl script? Currently I have database password stored in the perl script, and CGI scripts uses this perl script to connect to database. I would like to encrypt the database password in separate file.

I have shell script to encrypt password file. I have shell command to read encrypted file, but don't know how to use that in CGI/PERL.

Shell Command:
DB=`crypt $key_pw < login_file`;

 

[Deleted]

print crypt('password','junk text');

http://unixjunky.com

 

[devendrap]

Thanks for your quick response. Can I feed the values from file.

 

[devendrap]

The file will have only encrypted password.

 

[Deleted]

Oops .. this is to encrypt a password..

will post the decryption method is a sec

http://unixjunky.com

 

[devendrap]

Basically I am trying to put security on the database password, which is located in the CGI/PERL scripts. The encrypted CGI/PERL file needs read access to use for decryption script. If user knows the file name, user can put in the URL and open the file and get encryption password as well as method and key. They can decrypt the password themself. I am not sure how to secure the password in CGI/PERL.

 

[Deleted]

For encryption and decryption you can use the perl module Crypt::Blowfish which basically uses a key to encrypt and decrypt your info.

http://search.cpan.org/~dparis/Crypt-Blowfish-2.09/Blowfish.pm

I consider this method of protection kinda weak since all it takes is SSH access to read the file in question. You would be better off setting up seperate db passwords for each domain only allowing access from that domain (set-up mysql's Host & User tables).

http://unixjunky.com

 

[devendrap]

Thanks

 

[ChrisHunt]

If user knows the file name, user can put in the URL and open the file...

Which file are we talking about here? Surely not the file with the perl script in it? If the user puts in that URL, it'll execute the script - they won't see the source code.

If you're talking about a file that just contains the encrypted password, that doesn't need to be in the web-accessible space at all - so there's no URL they can put in. Even if they do read it somehow, they can't decrypt it without the key.

Now it's different if you're trying to protect yourself from people who can log on to your web host and look inside. If they can read your DB access script, there's nothing to stop them writing their own one that reads, decrypts and prints out the password. Frankly, though, if your attackers have that much access protecting the password is going to be the least of your problems.

-- Chris Hunt
Webmaster & Tragedian
Extra Connections Ltd