如何保护 Web 服务器用于解密数据库中字符串存储的私钥？
我正在开发一个小型应用程序，它将帮助用户通过废弃他们的 ISP 帐户页面轻松地从他们的 ISP 提供商处获取信息。为了实现这一点，我需要将他们的用户名和密码存储在我的数据库中。为了保证他们的密码安全，我将使用 openssl 公钥在我的数据库中对其进行编码，并在我的抓取工具登录到他们的帐户页面之前使用私钥对其进行解码。
我想知道将我的私钥放在哪里，这样即使有人控制了我的网络服务器，密码也是安全的？因为将私钥留在网络服务器上是完全不合适的...
tks
I'm developing a small app that will help users easily get information from their isp provider, by scrapping their isp account page. For that to be possible I need their username and password store in my db. To keep their password safe I will use an openssl public key to encode it in my db and a private key to decode it before my scraper logs in to their account page.
I'm wondering where to put my private key so the passwords are safe even if someone take controller of my web server? Because It would be totally inappropriate to just leave the private key on the web server...
tks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果有人完全控制您的服务器并对这些密码感兴趣，他就会成功。始终考虑到这一点并制定在这种情况下该怎么做的计划。
现在，为了使其尽可能困难且不可能实现这一目标，我建议将密钥（或者更好的是密码）存储在某种内存表中：例如 Ramdisk，这是一个每分钟仅给出一个密码的脚本，并且如果调用超过此值，则删除自身等等。
我在这里没有看到使用公钥加密的任何积极效果，无论您使用什么，解密的密钥都必须存储在服务器上。您可以查找描述 https 证书问题的 Howtos，它们应该受到密码保护，并且必须在服务器启动时阅读 - 问题是相关的。
一个好的解决方案可能是登录服务器，将密码文件存储在虚拟磁盘中，然后注销。在服务器重新启动、崩溃或密码更改时重复此操作。
If someone takes total control of your server and is interested in those passwords, he will succeed. Always take this into consideration and make plans on what to do in this case.
Now to make it as hard as possible and improbable to achieve this, I suggest to store the key (or better, the passwords) in some kind of memory table: like a Ramdisk, a script that will give out only one password per minute and delete itself if called more than that etc.
I don't see any positive effect of using public key encryption here, the key to decrypt must be stored on the server no matter what you use. You may look for Howtos that descripe the problem of https-certificates, they should be protected by passphrases and must be read on server start - the problem is related.
Probably a good solution would be to log into the server, store the passwordfile in a ramdisk and log out. Repeat on Server reboot, crash or password change.