1

I'm adding functionality for regular exports of data from our databases to a clients database. Clients will supply database details which we need to keep secure. What would the best way of securely storing the connection details, ideally they'd be stored in our main mysql database. I'd definitely want to avoid storing the password's in plaintext.

At the moment my best guess is some form of encryption with a hard coded key in the codebase, but that isn't much better than plaintext.

Shardj
  • 1,800
  • 2
  • 17
  • 43
  • So your clients are providing access details to push data to their database? And its these credentials that you wish to protect from loss/misuse? – danblack May 09 '19 at 10:58
  • Yes, exactly that. Ideally the client will only provide login details with access to the tables we need access to. But since it's possible they may have sensitive data on the database and have given us more permissions than we should have, then we need to make sure the database connection details are secure. – Shardj May 09 '19 at 11:24
  • clients* plural, just correcting the previous comment – Shardj May 09 '19 at 11:30
  • [Hashicorp's Vault](https://www.vaultproject.io/) perhaps? – Mjh May 09 '19 at 11:48
  • Likely more effort than we're willing to go to Mjh, but that's interesting to look at. It's currently looking like the best idea is to encrypt the data and include a warning for clients to make sure they input correct connection details that don't give us access to sensitive data. That way if there is a breach on our end, their database connection details can only provide non sensitive data we gave them. – Shardj May 09 '19 at 15:00

1 Answers1

0

Solution we decided on for securing client database passwords:

  • Create and store encryption key in aws parameter store
  • When adding passwords to mysql database, retrieve key from awsps, encrypt password and store
  • When connecting to remote client dbs, retrieve key from awsps, decrypt password, use
  • For local environments either use the the key stored on awsps (if there is no disadvantage to doing this) or check the environment and fallback to a local key value stored in a .ini file
Shardj
  • 1,800
  • 2
  • 17
  • 43