您在哪里存储数据库密码？
从代码中获取数据库和其他服务密码的方法有哪些？我已经阅读过有关使用每个服务器属性文件的信息，但是当您拥有大量服务器时，它会很难维护。我还看到了一种使用 CI 构建过程来“注入”密码的解决方案，但这使得动态更新密码变得困难。
一些有助于缩小答案范围的要求...
- 密码应该在发生安全漏洞时易于更改和传播。
- 密码不能出现在代码中（由于第 1 点）
- 对于人们来说，获得密码的纯文本版本应该是“不简单的”
- 应该在 Web 应用程序和独立应用程序中运行良好
- 易于应用程序开发人员采用 一些优点
包括不引入单点故障、快速的开发时间和易于理解。
这在精神上与这个问题类似，但非常强调可维护性和更多地关注服务器端的情况。
What are ways of getting database and other service passwords out of your code? I've read about using per server properties files but when you have a large number of servers it gets to hard to maintain. I've also seen a solution using a CI's build process to "inject" passwords but that makes it difficult to update the password on-the-fly.
Some requirements to help narrow the field of answers...
- The password should be easy to change and propagate in the event of a security breach.
- Password can not appear in code (due to point 1)
- It should be "non trivial" for a human to get a plain-text version of the password
- Should work well in the web application and stand alone applications
- Easy to adopt from a application developer standpoint
Some nice-to-haves include not introducing a single point of failure, a quick development time, and easy to understand.
This is similar in spirit to this question but with an strong emphasis on maintainability and focuses more on the server side case.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您可以将其以纯文本形式存储在受保护目录中的文件中，该目录只能由运行应用程序的帐户读取。对于 Web 应用程序，您应始终将密码存储在 Web 根文件夹之外。
You could store it in plain text in a file in a protected directory that can only be read by the account in which the application is run. In case of a web application, you should always store the password outside the web root folder.
如果您使用数据库连接池，那么用户名、密码和其他数据库详细信息通常在 Java Web 容器中管理，并作为数据源呈现给 Java 代码。您只需请求数据库连接，而无需了解任何这些详细信息。
If you use a database connection pool then the username, password and other database details are generally managed in the Java Web Container and presented to the Java code as a Datasource. You just ask for a Database connection without having to know any of these details.
除了将其存储在 Web 根目录之外的文本文件中之外，如何使用加密呢？对于大多数语言来说，使用加密方法是相当简单的，尽管它可能不是严格必要的以防止网络攻击，但它会让其他人更难访问您系统上的文件。此外，进行一些混淆，将文件伪装成其他名称很无聊的文件，很可能会被忽视，这样即使有人对服务器有物理访问权限，也不太可能找到它。
In addition to storing it in a text file outside web root, how about using encryption? With most languages, it's pretty trivial to use an encryption method and, though it might not be strictly necessary to protect from web attacks, it makes it more difficult for another person who may gain access to the file on your system. Additionally, a bit of obfuscation, disguising the file as something else with a boring name that will be likely overlooked, makes it less likely that someone will find it even in the event they have physical access to the server.