Storing sensitive information in Environment Variables

[munsiem]

I am by no means a security expert, but I would like to know if storing MySQL database information in an environment variable would be a good or bad idea. What are your thoughts?

[Adam]

By 'environment variable', do you mean putenv and getenv? I don't really see any benefit to this since they only exist for the life of the request.

[munsiem]

I am talking more about putenv. What I thought about doing is basically hiding the DB information by storing the info into an environment variable, like the following:

 

$_ENV['database'] = array("connection" =>  array("username" => "root",
				         "password" => "password",
				         "hostspec" => "localhost",
			                 "database" => "database"));	

 

I thought it might be an interesting idea to hide the sensitive information a bit better, but what do you think?

[trq]

How exactly does this hide anything though? You would still need to include this file into every other fiel that requires a database connection.

 

You could of course set the environment variables within your vhost config or .htaccess file, but still, these aren't exactly hidden.

[premiso]

If you are going to do that, why not just use the $_GLOBALS  array? Either or, once you are doing initiating your connection, I would destroy that array index, but that is my preference. 

 

Generally, most people store it outside of the Document Root for safe keepings. But either or if your server is compromised via a rogue include or similar, your data is at risk, so that is just a matter of preference I guess. You are better to make sure that you have your bases covered on the security end over worrying where they should be put, imo.

[munsiem]

I have the file that stores the database connections private - basically the whole framework is sunk except for the public facing files (all models, controllers, views, and sensitive information have been removed from the htdocs). I was just curious if I had stored the database connection using an environment variable if that would be some kind of security issue.

 

The main reason I ask is because earlier I did a phpinfo() and bam there was my database connection lol. I know of course that you wouldn't want to display phpinfo() to not let people know about your settings, but I just wanted to make sure that this wouldn't be as easily accessible anywhere else.

 

I too believe that as long as you hide your sensitive information you would be safe, but I wanted to make sure that this environment variable wasn't going to be a major risk when storing my connections.

[laffin]

doesnt hide anything, as soon as someone can get a phpinfo(); into the script, the gig is up. and you will be fortunate if they are good guys and advise you of this gaping hole in security. Mpst likely tho, they will be a lookee loo, to see what they can see with your db passwords, and maybe enlist help to alter the database.