如何安全地存储密码以供服务器端使用？
我正在寻找一种安全的方法来将 FTP 密码存储在仅可由特定用户使用的数据库中。 FTP 详细信息的存储方式应确保即使整个数据库暴露，FTP 密码也不会暴露。这可能应该依赖于用户的密码，仅当用户提示进行 FTP 操作时才临时解密 FTP 密码。我正在寻找可以实现此目的的解决方案。添加它涉及使用 javascript 和 php 的基于 Web 的应用程序可能很有用。
这不是关于如何使用 salt、散列、md5、sha1 等。这是关于保护服务器应该能够使用的 FTP 密码，例如连接到 FTP 服务器。这对于哈希来说是不可能的，因为这只是一种方法。应该使用一些对称密码方法。
示例用例：
- 用户登录到服务器
- 用户告诉服务器从安全存储在服务器上的 FTP 详细信息中下载文件
- 服务器查找 FTP 详细信息并删除加密（可能使用用户密码） 这个问题是关于如何有效地实施此步骤
- 服务器执行它必须执行的操作，然后删除未加密的密码
I'm looking for a secure way to store FTP passwords in a database that are usable only by specific users. The FTP details should be stored in a way that if the entire database is exposed that the FTP password isn't exposed. This probably should rely on the user's password to temporarily unencrypted the FTP password only when the user prompts for a FTP action. I'm looking for a solution that could implement this. Probably useful to add it concerns a web based application using javascript and php.
This is not about how to use salt, hashes, md5, sha1 etc. This is about securing FTP passwords that the server should be able to use e.g. connect to a FTP server with. This is simply not possible with hashes because those are only one way. Some symmetric password method should be used.
Example use case:
- User logs in to server
- User tells server to download file from his FTP details stored securely on the server
- Server looks up the FTP details and removes the encryption (possibly with the users password) This question is about how you implement this step effectively
- Server does whatever it has to do and then removes the unencrypted password
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您可以使用 Mcrypt： http://php.net/manual/book.mcrypt.php
You could use Mcrypt: http://php.net/manual/book.mcrypt.php
编辑：虽然以下内容似乎不再适用于该问题（现在似乎想要针对用户帐户运行 FTP 操作（未通过通用身份验证机制连接），但这需要可逆的计划），我离开它是因为我认为它包含有价值的信息。
我建议阅读彩虹表已经足够了：关于安全密码方案您需要了解的内容。
它可能会回答许多问题，包括盐是什么（如何防止彩虹攻击）、为什么 MD5 不是密码哈希的理想解决方案（它太快并且不再需要“重大的加密突破”）、什么如果数据受到损害（为什么不存储纯文本）等，就会发生这种情况。它提供了有价值的见解。
我真的很喜欢这句话：
这是非常真实的，即使是半开玩笑的。
Edit: While the following no longer appears to apply to the question (which now seems to want to run an FTP action on account of a user (not connected via a universal authentication mechanism), which requires a reversible scheme), I am leaving it because I think it contains valuable information.
I recommend reading Enough With The Rainbow Tables: What You Need To Know About Secure Password Schemes.
It will likely answer a number of questions, including what salt is (how to prevent rainbow attacks), why MD5 isn't an ideal solution for a password hash (it's too fast and no longer requires a "significant crypto breakthrough"), what can happen if data is compromised (why plain-text is not stored), etc. It provides valuable insights.
I really like this quote:
It's so true, even if tongue-in-cheek.
听起来您正在寻找的是 MD5 哈希值。
http://en.wikipedia.org/wiki/MD5
将密码存储到数据库，为了进一步提高安全性，您可能还需要研究对密码进行加盐处理。
http://en.wikipedia.org/wiki/Salt_(密码学)
It sounds like what you are looking for is an MD5 hash.
http://en.wikipedia.org/wiki/MD5
They are frequently used when storing passwords into a database, for further security you might also want to look into salting the password as well.
http://en.wikipedia.org/wiki/Salt_(cryptography)