0

I tried to figure it out, the most secure and flexible solution for storing in config file some credentials for database connection and other private info. This is inside a python module for logging into different handlers (mongodb, mysqldb, files,etc) the history of users activity in the system.

This logging module, is attached with a handler and its there where I need to load the config file for each handler. I.E. database, user, pass, table, etc.

After some research in the web and stackoverflow, I just saw mainly the security risks comparison between Json and CPickle, but concerning the eval method and the types restriction, more than the config file storage issue.

I was wondering if storing credentials in json is a good idea, due to the security risks involved in having a .json config file in the server (from which the logging handler will read the data). I know that this .json file could be retrieved by an http request. If the parameters are stored in a python object inside a .py code, I guess there is more security due to the fact that any request of this file will be interpreted first by the server, but I am loosing the flexibility of modularization and easy modification of this data.

What would you suggest for this kind of Security issues while storing this kind of config files in the server and accessed by some Python class? Thanks in advance, Luchux.

Luchux
  • 803
  • 1
  • 7
  • 17

1 Answers1

0

I'd think about encrypting the credentials file. The process that uses it will need a key/password to decrypt it, and you can store that somewhere else-- or even enter it interactively on server start-up. That way you don't have a single point of failure (though of course a determined intruder can eventually put the pieces together).

(Naturally you should also try to secure the server so that your credentials can't just be fetched by http request)

alexis
  • 48,685
  • 16
  • 101
  • 161
  • Thanks @alexis. Well encrypting was one solution, though JSON can't store non-printable characters, conditioning the encryption algorithm to be used. I implemented a decorator for my Serialization method, which encrypt the data to be serialized :) I couldn't find any documentation about encrypting built-in in the json lib. – Luchux Mar 07 '12 at 10:56