Linux用户帐户中是否存在秘密数据？
我希望我的应用程序（PHP，但这不重要）将一些数据存储在共享存储库（APC 用户缓存，但同样不相关）中。为了防止用户读取彼此的数据，我想对每个用户进行加密。
我可以让用户在应用程序的配置文件中指定密钥，但我宁愿自动生成它，这样用户就不必费心了。
为此，我需要系统上的一段数据（几乎）永远不会改变并且只能由当前用户读取。然后我可以对其进行散列或其他操作来生成密钥。 Linux 系统上的默认用户帐户中是否存在类似的内容？
I want my application (PHP, but that shouldn't matter) to store some data in a shared repository (the APC user cache, but again irrelevant). To prevent users from reading eachother's data I'd like to encrypt it per user.
I could have the user specify the key in his configuration file for the application, but I'd rather generate it automatically so the user doesn't have to bother.
For this I would need a piece of data on the system that (almost) never changes and is only readable by the current user. I can then hash that, or something, to generate the key. Does something like that exist in a default user account on a Linux system?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果您将密钥文件的权限设置为 0600，并将
~/.yourApp目录的权限设置为 0700，则可以将密钥存储在~/.yourApp中。当然，您依赖于那些无法/不愿意使用 root 访问权限来访问其他用户的密钥文件的人。如果这是一个问题，您将需要使用某种密钥库，其中访问由主密码控制。
编辑：回答以下OP的后续问题：
这都是相对的。如果你真的很偏执，你不会将密钥存储在任何你不能完全控制的机器上。另一方面，大多数人准备相信 root 没有受到损害，并且（作为后备）拥有 root 访问权限的人需要付出一些努力才能破解密钥库。内存中密钥库的未锁定副本可能被视为“足够安全”。当然，许多用户密钥库软件似乎都基于这种假设。
部分是一般性偏执，部分是腰带和大括号，部分是向其他用户发出“不要干涉我的私人物品”的信号，部分是通过替换您的密钥文件来防止他人入侵。最后一点可能很关键……也可能不是……具体取决于您的应用程序如何使用密钥。
Storing a key in
~/.yourAppwill work, provided that you set the permissions of the key file to 0600 and the permissions of the~/.yourAppdirectory to 0700.Of course you are relying on people not being able / willing to use root access to access other users' key files. If that is a concern you are going to need to use some kind of keystore where access is controlled by a master passphrase.
EDIT : in answer to the OP's followup questions below:
It is all relative. If you are really paranoid, you don't store the key on any machine that you don't totally control. On the other hand, most people are prepared to trust that root has not been compromised and (as a fallback) that it requires some effort for someone with root access to break a keystore. An unlocked copy of your keystore in memory may count as "safe enough". Certainly, a lot of user keystore software seems to work on that assumption.
Partly general paranoia, partly belt-and-braces, partly a sign to other users to "keep your nose out of my private stuff", and partly to protect against someone by replacing your key file. The last point could be critical ... or not ... depending on exactly how the key is used by your application.
主目录中有隐藏文件夹，简单命名为.appname。用户可以阅读它们。
如何生成随机密钥并将其存储在 ~/.yourappname 中？
There are hidden folders in the home directory, simply named .appname. They can be read by the user.
How just generating a random key, and store it in ~/.yourappname?