使用 Drupal 存储敏感数据
我需要通过 Drupal 使用敏感数据来使用自定义模块。如果我只是通过 GUI 设置它们，它们将未加密地存储在数据库中。任何有权访问它的人都可以访问我的敏感数据。
目前我可以看到两种解决方案：
- 找到一种方法将这些凭据安全地存储到数据库中；
- 将这些敏感数据放入credentials_inc.php 文件中，将其包含在settings.php 中以设置我的自定义模块可以使用的变量，并确保其他人无法读取该文件。
您认为哪种解决方案最好？你有什么建议吗？还有其他最佳选择吗？
此致。
I need to use sensitive data with Drupal for a custom module to use. If I simply set them through the GUI, they will be stored unencrypted in the database. Anyone having access to it will have access to my sensitive data.
I can see two solutions for the moment:
- Find a way to securely store those credentials into the database;
- Put those sensitive data into a credentials_inc.php file, include it in settings.php to set variables my custom module could use and make sure that nobody else can read the file.
Which solution is best according to you? What do you recommend? Is there any other best option?
Best regards.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我将首先使用 SecurePages 模块，以确保沿途输入的数据不会被窥探。
然后，要加密信息，请尝试使用 php 的 mcrypt 并通过一个简短的示例说明如何< a href="http://www.php.net/manual/en/function.mcrypt-encrypt.php" rel="noreferrer">加密 和 解密。
一旦信息得到保护，将数据存储在 drupal 的数据库结构中应该没有问题。另外，重要的一点是，您可以查看 hook_init() 而不是尝试在 settings.php 中添加某些内容。这通常是一种不好的做法。
I would start off by using SecurePages module, to make sure the data entered somewhere along the way is not snooped.
Then to encrypt the information try using php's mcrypt with a short example of how to encrypt and decrypt.
Once the information is secured, you should have no problem storing the data in drupal's db structure. Also, an important note, you might check out hook_init() instead of trying to append something in settings.php. That is in general a bad practice.
加密模块提供了一个API，支持几种不同的加密方法，包括mcrypt（如果您启用了它） 。
The Encryption module provides an API that supports a few different encryption methods, including mcrypt (if you have it enabled).
加密模块是在 Drupal 中加密敏感数据的绝佳方法。然而，该模块没有提供足够的密钥管理（它将加密密钥存储在 Drupal 数据库中 - 就像将您家的密钥存储在欢迎垫下一样）。
除了加密之外，您还需要一个额外的模块，例如 Townsend 安全密钥连接，它允许您在加密密钥管理器（HSM、云、VMware 等）中管理 Drupal 数据库外部的加密密钥。 ）。请记住 - 如果您没有正确管理加密密钥，那么您就没有正确加密您的数据。
全面披露：我在 Drupal 团队中与 Townsend Security 合作。
The Encryption module is an excellent way to encrypt sensitive data within Drupal. However, this module does not provide adequate key management (it stores the encryption key within the Drupal database - like storing the keys to your house under your Welcome mat).
Along with Encrypt, you will also need an additional module like Townsend Security Key Connection which allows you to manage the encryption keys outside of the Drupal database in an encryption key manager (HSM, Cloud, VMware, etc.). Just remember - if you aren't properly managing your encryption keys, you aren't properly encrypting your data.
Full Disclosure: I work with Townsend Security on the Drupal team.