3

I've been doing a lot of reading about password security over the last few days. The posts generally have long comment threads that make it difficult to determine a definitive answer.

In general, it seems to be recommended practice to

  • store the database connection password in a separate config file above document root. This file is kept out of version control and protected by the file system permissions.

  • hash user passwords using a proven secure hashing algorithm with a salt that is unique for each password.

I don't want to rehash (pun intended) the same questions that have already been asked and answered before. So I don't want to get into the specifics of how to secure the passwords.

What I am trying to understand is why there is so much talk (and disagreement) about how to make the user passwords secure if it's acceptable to store the database connection password in plain text.

Why are the passwords stored in the database more vulnerable than the config file that holds the connection password? Doesn't an attacker need to get access to my system in order to get the user passwords from my database?

In my case, I am using PHP/MySQL on CentOS, but this question could apply to other environments as well.

3 Answers 3

1

What I am trying to understand is why there is so much talk (and disagreement) about how to make the user passwords secure if it's acceptable to store the database connection password in plain text.

There is so much disagreement for three reasons. First, the discussion usually lacks a threat model. Second, opinions differ on what a threat is. Third, opinions differ on what to do for a particular threat. Since threats are not well defined, folks omit some threats and toss their opinions in on others.

John Stevens of OWASP put together a good document on server password security and storage. It walks through the attacks and threats, and then adds steps to neutralize the threats. Here are the references to the OWASP material:


So I don't want to get into the specifics of how to secure the passwords.

Well, after you have a threat model, then the devil is in the details.


Why are the passwords stored in the database more vulnerable than the config file that holds the connection password?

It depends on a lot of things. For example, what if an admin has access to the config file and then leaves the company. Or what if you send the database backup offsite? Are those threats in your threat model?


Doesn't an attacker need to get access to my system in order to get the user passwords from my database?

You need a well defined threat model.

Again, how about the admin who exits the company? He had access to all the passwords.

Or how about the backup that goes offsite? The courrier and the site staff have access to the passwords.

Or how about a FISA letter to turn over all usernames and passwords. Lavabit shut down because the government demanded everything, and not the passwords and keys for the one user they were interested in (Edward Snowden).

None of those threats involve a remote attacker trying to break into your system.


Doesn't an attacker need to get access to my system in order to get the user passwords from my database?

All things being equal, NO. The bad guys is going to try to phish your users because that's easiest.


For more reading on passwords (beyond just storage), see Peter Gutmann's Engineering Security. Did you know its a bad idea to use a password complexity policy? And its a bad idea to expire passwords after N days? Guttman's book tells you why and cites the relevant security study.

0

Consider what vulnerabilities are typically required for an attacker to retrieve either of the passwords:

  • User passwords are stored in the database and are typically leaked by SQL injections. Depending on how the passwords are stored, the attacker may require some additional steps to retrieve the passwords.

  • The Database password is typically stored in a file, so a file read/inclusion or code/command execution is required to read the file.

But accessing the database is often restricted to only certain networks or machines, i. e., the web server. So an attacker requires at least code/command execution on the web server to being able to access the database. And if an attacker is able to execute arbitrary code/commands on the web server, the web server is already totally compromised.

2
  • Your last paragraph is what I was try to get at in my question. If the attacker requires at least code/command execution on the web server to be able to access the database, why is the database considered more vulnerable than the file system? Your point about SQL injection explains one possibility. Does that mean I should always assume that the code itself is insecure and vulnerable to SQL injections?
    – toxalot
    Mar 22, 2014 at 11:41
  • @toxalot No, the database is not considered more vulnerable. It’s just that the web application needs to authenticate on the database. And therefor it requires the password in plaintext. So you can’t prevent the web application from access to the password as that would render the application not working.
    – Gumbo
    Mar 22, 2014 at 12:00
0

There are several reasons, why you want to protect the user-passwords more than your database connection-password:

  1. User-passwords can be protected with a one way hash function, while it is not possible to protect a connection-password the same way, the application finally needs this password plaintext to open the database.
  2. User-passwords should be protected for the case that an attacker has already stolen the password-hashes.
  3. SQL-injection is an easy way to get the user-password-hashes, you don't need privileges on the server. To get the connection-password you need server privileges, which is much more difficult to get. If you are interested, i made a demo page to show how easy it can be.
  4. A leaking user-password can compromise other sites as well, because people are reusing the same password on several sites.
  5. There are other ways to lose user-password-hashes, thrown away backups, disregarded servers, ... Often this ways are not under your control (external provider, external developers).
3
  • Point 1 is actually not entirely true; you could easily have a randomly generated starting passphrase, then use PBKDF2/BCrypt/SCrypt to generate a hash with a high iteration count/work factor, convert the output to Base64 or hex, and then set the connection password to that result value. It doesn't do much, but it does require either connection level interception or reading both the config files and the code, rather than just the config files. Mar 23, 2014 at 4:06
  • @Anti-weakpasswords - If somebody can read the config file, (s)he can very likely read the code too, both require privileges on the server. You can make it a bit more difficult, but finally a password must be sent and that must be plaintext. That's why i said a safe one-way hash function cannot be used to secure the connection-password. Mar 23, 2014 at 9:09
  • I agree, which is why I said "It doesn't do much" - it's a very pathetic layer, but it is a layer, and short of adding an HSM to the encryption key mix or changing to some OS level authentication (Trusted authentication in Windows), it's quite difficult to protect connection passwords. Mar 23, 2014 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.