How to avoid exposing connectstring?

[James Henson]

I'm using a MySQL database from within some Perl and PHP cgi's.
To make the connection, I have to supply the username/password
in the connection string. This info is readable for anyone that
can view my code, e.g. all other users that can access the
webserver box directly. This because the cgi-program has to be
readable for the user that's used by Apache.

How can I avoid this? I can't have my own webserver, regrettably,
other developers have access to this machine. Is there perhaps an
Apache option that I can use to avoid public exposure of the
connectstring?

I have set up the database server so it only accepts connections
from the webserver box, but that doesn't help with the above
problem.

Any pointers?

James

[Justin Koivisto]

Re: How to avoid exposing connectstring?

James Henson wrote:[color=blue]
>
> I'm using a MySQL database from within some Perl and PHP cgi's.
> To make the connection, I have to supply the username/password
> in the connection string. This info is readable for anyone that
> can view my code, e.g. all other users that can access the
> webserver box directly. This because the cgi-program has to be
> readable for the user that's used by Apache.
>
> How can I avoid this? I can't have my own webserver, regrettably,
> other developers have access to this machine. Is there perhaps an
> Apache option that I can use to avoid public exposure of the
> connectstring?
>
> I have set up the database server so it only accepts connections
> from the webserver box, but that doesn't help with the above
> problem.
>
> Any pointers?[/color]

In httpd.conf, add this in your VirtualHost directive...

SetEnv SQL_HOST=localh ost
SetEnv SQL_PASS=passwo rd
SetEnv SQL_USER=user

Then, make sure httpd.conf is chmod 600 and chown root.root

Now, in your scripts, access these variables via
<?php
$host=$_SERVER['SQL_HOST'];
$user=$_SERVER['SQL_USER'];
$pass=$_SERVER['SQL_PASS'];
?>

I'm not sure how to go about it in perl, but it will likely be an
environment variable.

If the host won't chmod and chown httpd.conf, you have create a separate
file with the parameters in it, chmod 600, chown root.root that file
instead, and use an include in the VirtualHost directive.

Since it is in your VirtualHost directive, it is only valid for requests
to your domain name, and only the root user will be able to read the
file with the user and password.

--
Justin Koivisto - spam@koivi.com
PHP POSTERS: Please use comp.lang.php for PHP related questions,
alt.php* groups are not recommended.

[Kevin Thorpe]

Re: How to avoid exposing connectstring?

James Henson wrote:[color=blue]
>
> I'm using a MySQL database from within some Perl and PHP cgi's.
> To make the connection, I have to supply the username/password
> in the connection string. This info is readable for anyone that
> can view my code, e.g. all other users that can access the
> webserver box directly. This because the cgi-program has to be
> readable for the user that's used by Apache.
>
> How can I avoid this? I can't have my own webserver, regrettably,
> other developers have access to this machine. Is there perhaps an
> Apache option that I can use to avoid public exposure of the
> connectstring?
>
> I have set up the database server so it only accepts connections
> from the webserver box, but that doesn't help with the above
> problem.[/color]

I really don't think this is possible. It's easy to protect such things
from external (ie web) users, but anyone who has access to a prompt and
enough rights to read any files the webserver can will be able to read
your file.

Why don't you trust your (I assume) colleagues? Someone must have the
root password and full access to the box so there's nowhere to hide.

[James Henson]

Re: How to avoid exposing connectstring?

Kevin Thorpe wrote:
[color=blue]
> Why don't you trust your (I assume) colleagues? Someone must have the
> root password and full access to the box so there's nowhere to hide.[/color]

The application gets installed on a customers server. As there are
several other vendors apps at this server, I try to minimize
potential mishaps. It won't be the first time I lose a database
because of 'curious' developers. I'm not worried about the admin,
because she is employed by the customer (not third-party).

As someone said:
"Trust your neighbour, but don't forget to lock your door."

James

[Gubba Bump]

Re: How to avoid exposing connectstring?

On Fri, 31 Oct 2003 16:08:16 +0100, James Henson wrote:
[color=blue]
> ...snip... other developers have access to this machine. Is there
> perhaps an Apache option that I can use to avoid public exposure of the
> connectstring? ...snip...
>
> James[/color]

Others have addressed the tech already, so I'll not.

Sounds as if you need to have a direct talk with some of your fellow
developers. Speak to your admin first, and see if that works. I had
similar issues in the last web shop I was at --- noobs who ended up
playing in my files and databases so they could "learn". Unfortunately,
It took them trashing a finished customer site before my boss opened her
ears. Fortunately, I had everything, including the database, copied safely
into some non-accessible directories on my development machine.

So backup, talk to your boss, then, if necessary, talk to the children.

Luck,
Chuck Kinney