As responsible admins we know of common weaknesses like
- CWE-260: Password in Configuration File http://cwe.mitre.org/data/definitions/260.html
- CWE-522: Insufficiently Protected Credentials http://cwe.mitre.org/data/definitions/522.html
- CWE-257: Storing Passwords in a Recoverable Format http://cwe.mitre.org/data/definitions/557.html
But how do we deal with this in practice?
Of course with technologies like passwordless authentication via SSH and tools like sudo, it is possible to get rid of stored login credentials in important places and this really helps during automated deployment of Linux servers.
But as soon as you leave the operating system and install applications, chances are high that you are confronted with the issue where to securely store the passwords.
For example if you install a database server, most likely you need to save the cleartext password to a configuration file of your web application.
Then you should secure the configuration file so that only the admin is able to view the credentials and you should limit the access permissions of the database user in order to limit the possible security impact.
But how to deal with e.g. the main administrative database account? At least your dbas should know it (so you need somewhere the cleartext) and as OS admin you should not know the credentials. Or the deployment is done by devops and they should not know any of the credentials on production servers.
Possible solutions
After thinking this through for a longer period of time, I come up with three possible solutions but they have weaknesses of their own:
Generate random credentials during deployment and store it in a database in a write once fashion. And e.g. dbas have another user that may read only database credentials. But how to deal with cleartext passwords in configuration files of e.g. webapps? A root user could read them. Also the root user of the password database could possibly read all password credentials.
Accept cleartext passwords and default credentials during deployment and add a postscript that changes any and all passwords. Maybe even interactive where authorized people have to enter the credentials during runtime of the script.
Encrypt the password asymmetrically with the key of a trusted thirdparty. When password gets requested, it must be changed afterwards.
What do you think? Do you see any best practices here?