Rails 目录树中的系统密码存储在哪里？
我的 Rails 应用程序中有许多“系统”密码，例如数据库密码和 XML feed 的单独 HTTP 身份验证密码。
我的麻烦是确切地知道如何将这些密码存储在我的目录中，以便它们尽可能安全。您对 Rails 3 有哪些具体建议？
I have a number of 'system' passwords in my Rails app, such as database passwords and separate HTTP authentication passwords for an XML feed.
My trouble is knowing exactly how to store these passwords in my directory so they are as safe as they can be. What are your recommendations specifically for Rails 3?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
加密在数据库中？
在环境配置中？
我过去都用过。事实上，HTTP 密码更像是 API 密钥。服务提供商有责任确保您不能利用访问权限做任何“邪恶”的事情。一般来说，建议不要将任何您不想公开的内容放入源代码管理中。过去，我必须在应用程序之外部署单独的密钥文件。如果您正在做真正安全的事情（例如信用卡），那么您可以这样做。只需在服务器上创建一个有权访问密钥文件的用户即可。那么您实际上是使用对 Unix 机器的访问作为您的安全模型，而不是密钥文件的密码。
encrypted in a database?
in environment config?
I've used both in the past. The reality is that HTTP passwords are more like an API key. The provider of the service has the responsibility that you can't do anything 'evil' with access. In general, recommend against putting anything in source control you don't want to be public. In the past, I've had to deploy separate key files outside of my app. If you're doing really secure stuff (a la credit cards), then you can do that. And just create a user on the server that has access to the keyfiles. Then you're actually using access to the Unix box as your security model, not the password to your keyfiles.
只需确保将配置文件存储在配置文件夹中（或至少存储在公共文件夹之外；）。除此之外，您应该保护从外部对您的rails-app-user-account 的访问（强制ssh-pubkey 身份验证）。
另一个安全缺陷是使用合理的密码信息（例如数据库访问）签入的配置文件。我总是将 config/database.yml 添加到 .gitignore 并签入默认的 config/database.sample.yml 作为其他开发人员的模板。 “真正的”config/database.yml 是使用特定于环境的配置值手动创建和配置的。
Just make sure to store your config-files in the config-folder (or at least outside the public-folder ;). Besides this you should secure the access to your rails-app-user-account from outside (force ssh-pubkey authentication).
Another security-flaw is checked-in config-files with sensible password information (e.g. database-access). I alway add config/database.yml to .gitignore and check-in a default config/database.sample.yml as a template for other developers. The "real" config/database.yml is created and configured manually with environment-specific configuration-values.