password encription in php

javier_ccs · 03-08-2007, 05:13 PM

Hello,

i have a php appl that connects to a mysql db server, of curse i have to include the user and passwd, so far i have done it clear text...

i would like to know how can i encript that user & passwd so nobody can see it if doing a cat, more or vi...

i cant change the permission on the .php

graemef · 03-09-2007, 03:02 AM

You can put the password in its own file and place that file in a directory that only the server has access to and don't allow directory browsing.

javier_ccs · 03-09-2007, 06:38 AM

thanx...

i have the web server running with user1 from the group users.

and the appl needs to be able to read that file anytime it must connect to the db, so i guess that user1 from the group users mut have read permissions on that file, and the user and passwd on the file stills are clear text...

i need to know if i can encript the passwd on the file...so the people that makes vi, cat or more.... doesnt see the passwd

graemef · 03-09-2007, 09:56 PM

How would you unencrypt the file? Another password? if so where would you keep that other password?

The only way to make it secure is for the user to provide the password, but if the users who have access to an editor don't have rights to the file then you are on the right track.

jlinkels · 03-10-2007, 08:19 AM

This might give you some ideas:

http://simonwillison.net/2003/Apr/20/javascriptMD5/

The principle is that you encrypt information on both sides (server and client), send over the encrypted information and do a compare at the server side.

jlinkels

graemef · 03-10-2007, 11:46 PM

Quote:

Originally Posted by jlinkels

The principle is that you encrypt information on both sides (server and client), send over the encrypted information and do a compare at the server side.

That's fine for when the client is logging into the server but the database password is normally different, and Mysql expects the password to be in plain text (as far as I am aware), remember MD5 is a one-way translation. But this idea works well with client to server authentication.