Encrypting connection strings in a shell file
I work in a large organization with dozens if not hundreds of dev teams working on various products, and one of our goals is to try and establish some standards around encrypting confidential information. One of our big struggles is connection information (say to a database) in a config file. For Windows, and specifically .NET applications, we've found an elegant solution with ASP.NET 2.0 and some of the included providers (RSA and DPAPI). Unfortunately, we haven't found a great solution to this problem for our Unix-like systems. So...
I'm aware of the the third party library OpenSSL and the rsautl command, as well as the GnuPG solution. Are there any others that come to mind?
If no to the above, does anyone have experience with both and could recommend one over the other?
It seems to me that both of the above solutions will encrypt an entire script file as opposed to specific elements (like the connection string). Is there any way to encrypt just a specific section of a file?
shell-script encryption
edited Jan 27 at 1:33
RalfFriedl
5,4103925
asked Jan 27 at 0:56
linux_newblinux_newb
61
|
show 2 more comments
I work in a large organization with dozens if not hundreds of dev teams working on various products, and one of our goals is to try and establish some standards around encrypting confidential information. One of our big struggles is connection information (say to a database) in a config file. For Windows, and specifically .NET applications, we've found an elegant solution with ASP.NET 2.0 and some of the included providers (RSA and DPAPI). Unfortunately, we haven't found a great solution to this problem for our Unix-like systems. So...
I'm aware of the the third party library OpenSSL and the rsautl command, as well as the GnuPG solution. Are there any others that come to mind?
If no to the above, does anyone have experience with both and could recommend one over the other?
It seems to me that both of the above solutions will encrypt an entire script file as opposed to specific elements (like the connection string). Is there any way to encrypt just a specific section of a file?
shell-script encryption
edited Jan 27 at 1:33
RalfFriedl
5,4103925
asked Jan 27 at 0:56
linux_newblinux_newb
61
Is the question: How can I encrypt passwords that are used by programs to connect to a database? ..... If so, some databases offer methods of supplying authentication information and credentials through per user password files or system user authentication rather than using a password stored in plaintext in a config file... The answer may depend on which database you are using, unless you are looking for a generic encryption method... There are also databases that allow encryption per column, so it's definitely possible to store a list of passwords in an encrypted column in a DB.
– RubberStamp
Jan 27 at 1:22
Who are you hiding these strings from, and why? People who already have root access can eventually read everything. Would ssh keys not work? Or why not encrypt the entire system, instead of just a few lines or files? Also, if you're considering making your own DIY encryption scheme vs GPG, you might want to stick with the one with decades of secure tested use (GPG), and especially avoid openssl'senccommand, see OpenSSL vs GPG for encrypting off-site backups?
– Xen2050
Jan 27 at 13:10
@Xen2050 ... I think the OP's problem is this one ...
– RubberStamp
Jan 27 at 13:44
@RubberStamp - yes, we're looking for a generic encryption method. While encrypting the plain text password for a DB connection is the primary use case, we want to come up with some generic standards around encrypting any kind of sensitive data in logs and config files. Also, appreciate the link to the other thread as this gives my team some other possibilities to consider.
– linux_newb
Jan 27 at 19:54
>encrypting any kind of sensitive data in logs and config files. ......... Encrypting snippets of text within a file is possible, but not really practical. The encrypted word or line is going to need to be decrypted at a certain point. ..... I'm not familiar with ASP.NET, but I found this ASP.NET 2.0 allows storing connectionString elements within the connectionStrings section in web.config. The web.config section containing connection strings can be encrypted for security. .... separate config file.
– RubberStamp
Jan 27 at 21:19
|
show 2 more comments
I work in a large organization with dozens if not hundreds of dev teams working on various products, and one of our goals is to try and establish some standards around encrypting confidential information. One of our big struggles is connection information (say to a database) in a config file. For Windows, and specifically .NET applications, we've found an elegant solution with ASP.NET 2.0 and some of the included providers (RSA and DPAPI). Unfortunately, we haven't found a great solution to this problem for our Unix-like systems. So...
I'm aware of the the third party library OpenSSL and the rsautl command, as well as the GnuPG solution. Are there any others that come to mind?
If no to the above, does anyone have experience with both and could recommend one over the other?
It seems to me that both of the above solutions will encrypt an entire script file as opposed to specific elements (like the connection string). Is there any way to encrypt just a specific section of a file?
shell-script encryption
edited Jan 27 at 1:33
RalfFriedl
5,4103925
asked Jan 27 at 0:56
linux_newblinux_newb
61
I work in a large organization with dozens if not hundreds of dev teams working on various products, and one of our goals is to try and establish some standards around encrypting confidential information. One of our big struggles is connection information (say to a database) in a config file. For Windows, and specifically .NET applications, we've found an elegant solution with ASP.NET 2.0 and some of the included providers (RSA and DPAPI). Unfortunately, we haven't found a great solution to this problem for our Unix-like systems. So...
I'm aware of the the third party library OpenSSL and the rsautl command, as well as the GnuPG solution. Are there any others that come to mind?
If no to the above, does anyone have experience with both and could recommend one over the other?
It seems to me that both of the above solutions will encrypt an entire script file as opposed to specific elements (like the connection string). Is there any way to encrypt just a specific section of a file?
shell-script encryption
shell-script encryption
edited Jan 27 at 1:33
RalfFriedl
5,4103925
asked Jan 27 at 0:56
linux_newblinux_newb
61
edited Jan 27 at 1:33
RalfFriedl
5,4103925
asked Jan 27 at 0:56
linux_newblinux_newb
61
edited Jan 27 at 1:33
RalfFriedl
5,4103925
edited Jan 27 at 1:33
RalfFriedl
5,4103925
edited Jan 27 at 1:33
RalfFriedl
5,4103925
5,4103925
asked Jan 27 at 0:56
linux_newblinux_newb
61
asked Jan 27 at 0:56
linux_newblinux_newb
61
asked Jan 27 at 0:56
linux_newblinux_newb
61
61
Is the question: How can I encrypt passwords that are used by programs to connect to a database? ..... If so, some databases offer methods of supplying authentication information and credentials through per user password files or system user authentication rather than using a password stored in plaintext in a config file... The answer may depend on which database you are using, unless you are looking for a generic encryption method... There are also databases that allow encryption per column, so it's definitely possible to store a list of passwords in an encrypted column in a DB.
– RubberStamp
Jan 27 at 1:22
Who are you hiding these strings from, and why? People who already have root access can eventually read everything. Would ssh keys not work? Or why not encrypt the entire system, instead of just a few lines or files? Also, if you're considering making your own DIY encryption scheme vs GPG, you might want to stick with the one with decades of secure tested use (GPG), and especially avoid openssl'senccommand, see OpenSSL vs GPG for encrypting off-site backups?
– Xen2050
Jan 27 at 13:10
@Xen2050 ... I think the OP's problem is this one ...
– RubberStamp
Jan 27 at 13:44
@RubberStamp - yes, we're looking for a generic encryption method. While encrypting the plain text password for a DB connection is the primary use case, we want to come up with some generic standards around encrypting any kind of sensitive data in logs and config files. Also, appreciate the link to the other thread as this gives my team some other possibilities to consider.
– linux_newb
Jan 27 at 19:54
>encrypting any kind of sensitive data in logs and config files. ......... Encrypting snippets of text within a file is possible, but not really practical. The encrypted word or line is going to need to be decrypted at a certain point. ..... I'm not familiar with ASP.NET, but I found this ASP.NET 2.0 allows storing connectionString elements within the connectionStrings section in web.config. The web.config section containing connection strings can be encrypted for security. .... separate config file.
– RubberStamp
Jan 27 at 21:19
|
show 2 more comments
Is the question: How can I encrypt passwords that are used by programs to connect to a database? ..... If so, some databases offer methods of supplying authentication information and credentials through per user password files or system user authentication rather than using a password stored in plaintext in a config file... The answer may depend on which database you are using, unless you are looking for a generic encryption method... There are also databases that allow encryption per column, so it's definitely possible to store a list of passwords in an encrypted column in a DB.
– RubberStamp
Jan 27 at 1:22
Who are you hiding these strings from, and why? People who already have root access can eventually read everything. Would ssh keys not work? Or why not encrypt the entire system, instead of just a few lines or files? Also, if you're considering making your own DIY encryption scheme vs GPG, you might want to stick with the one with decades of secure tested use (GPG), and especially avoid openssl'senccommand, see OpenSSL vs GPG for encrypting off-site backups?
– Xen2050
Jan 27 at 13:10
@Xen2050 ... I think the OP's problem is this one ...
– RubberStamp
Jan 27 at 13:44
@RubberStamp - yes, we're looking for a generic encryption method. While encrypting the plain text password for a DB connection is the primary use case, we want to come up with some generic standards around encrypting any kind of sensitive data in logs and config files. Also, appreciate the link to the other thread as this gives my team some other possibilities to consider.
– linux_newb
Jan 27 at 19:54
>encrypting any kind of sensitive data in logs and config files. ......... Encrypting snippets of text within a file is possible, but not really practical. The encrypted word or line is going to need to be decrypted at a certain point. ..... I'm not familiar with ASP.NET, but I found this ASP.NET 2.0 allows storing connectionString elements within the connectionStrings section in web.config. The web.config section containing connection strings can be encrypted for security. .... separate config file.
– RubberStamp
Jan 27 at 21:19
Is the question: How can I encrypt passwords that are used by programs to connect to a database? ..... If so, some databases offer methods of supplying authentication information and credentials through per user password files or system user authentication rather than using a password stored in plaintext in a config file... The answer may depend on which database you are using, unless you are looking for a generic encryption method... There are also databases that allow encryption per column, so it's definitely possible to store a list of passwords in an encrypted column in a DB.
– RubberStamp
Jan 27 at 1:22
Is the question: How can I encrypt passwords that are used by programs to connect to a database? ..... If so, some databases offer methods of supplying authentication information and credentials through per user password files or system user authentication rather than using a password stored in plaintext in a config file... The answer may depend on which database you are using, unless you are looking for a generic encryption method... There are also databases that allow encryption per column, so it's definitely possible to store a list of passwords in an encrypted column in a DB.
– RubberStamp
Jan 27 at 1:22
Who are you hiding these strings from, and why? People who already have root access can eventually read everything. Would ssh keys not work? Or why not encrypt the entire system, instead of just a few lines or files? Also, if you're considering making your own DIY encryption scheme vs GPG, you might want to stick with the one with decades of secure tested use (GPG), and especially avoid openssl's
enc command, see OpenSSL vs GPG for encrypting off-site backups?– Xen2050
Jan 27 at 13:10
Who are you hiding these strings from, and why? People who already have root access can eventually read everything. Would ssh keys not work? Or why not encrypt the entire system, instead of just a few lines or files? Also, if you're considering making your own DIY encryption scheme vs GPG, you might want to stick with the one with decades of secure tested use (GPG), and especially avoid openssl's
enc command, see OpenSSL vs GPG for encrypting off-site backups?– Xen2050
Jan 27 at 13:10
@Xen2050 ... I think the OP's problem is this one ...
– RubberStamp
Jan 27 at 13:44
@Xen2050 ... I think the OP's problem is this one ...
– RubberStamp
Jan 27 at 13:44
@RubberStamp - yes, we're looking for a generic encryption method. While encrypting the plain text password for a DB connection is the primary use case, we want to come up with some generic standards around encrypting any kind of sensitive data in logs and config files. Also, appreciate the link to the other thread as this gives my team some other possibilities to consider.
– linux_newb
Jan 27 at 19:54
@RubberStamp - yes, we're looking for a generic encryption method. While encrypting the plain text password for a DB connection is the primary use case, we want to come up with some generic standards around encrypting any kind of sensitive data in logs and config files. Also, appreciate the link to the other thread as this gives my team some other possibilities to consider.
– linux_newb
Jan 27 at 19:54
>encrypting any kind of sensitive data in logs and config files. ......... Encrypting snippets of text within a file is possible, but not really practical. The encrypted word or line is going to need to be decrypted at a certain point. ..... I'm not familiar with ASP.NET, but I found this ASP.NET 2.0 allows storing connectionString elements within the connectionStrings section in web.config. The web.config section containing connection strings can be encrypted for security. .... separate config file.
– RubberStamp
Jan 27 at 21:19
>encrypting any kind of sensitive data in logs and config files. ......... Encrypting snippets of text within a file is possible, but not really practical. The encrypted word or line is going to need to be decrypted at a certain point. ..... I'm not familiar with ASP.NET, but I found this ASP.NET 2.0 allows storing connectionString elements within the connectionStrings section in web.config. The web.config section containing connection strings can be encrypted for security. .... separate config file.
– RubberStamp
Jan 27 at 21:19
|
show 2 more comments
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f496952%2fencrypting-connection-strings-in-a-shell-file%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f496952%2fencrypting-connection-strings-in-a-shell-file%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Is the question: How can I encrypt passwords that are used by programs to connect to a database? ..... If so, some databases offer methods of supplying authentication information and credentials through per user password files or system user authentication rather than using a password stored in plaintext in a config file... The answer may depend on which database you are using, unless you are looking for a generic encryption method... There are also databases that allow encryption per column, so it's definitely possible to store a list of passwords in an encrypted column in a DB.
– RubberStamp
Jan 27 at 1:22
Who are you hiding these strings from, and why? People who already have root access can eventually read everything. Would ssh keys not work? Or why not encrypt the entire system, instead of just a few lines or files? Also, if you're considering making your own DIY encryption scheme vs GPG, you might want to stick with the one with decades of secure tested use (GPG), and especially avoid openssl's
enccommand, see OpenSSL vs GPG for encrypting off-site backups?– Xen2050
Jan 27 at 13:10
@Xen2050 ... I think the OP's problem is this one ...
– RubberStamp
Jan 27 at 13:44
@RubberStamp - yes, we're looking for a generic encryption method. While encrypting the plain text password for a DB connection is the primary use case, we want to come up with some generic standards around encrypting any kind of sensitive data in logs and config files. Also, appreciate the link to the other thread as this gives my team some other possibilities to consider.
– linux_newb
Jan 27 at 19:54
>encrypting any kind of sensitive data in logs and config files. ......... Encrypting snippets of text within a file is possible, but not really practical. The encrypted word or line is going to need to be decrypted at a certain point. ..... I'm not familiar with ASP.NET, but I found this ASP.NET 2.0 allows storing connectionString elements within the connectionStrings section in web.config. The web.config section containing connection strings can be encrypted for security. .... separate config file.
– RubberStamp
Jan 27 at 21:19