Is it secure to store passwords as environment variables (rather than as plain text) in config files?

ruby-on-rails django security passwords environment-variables
jay picture jay · Sep 17, 2012 · Viewed 60.2k times · Source

I work on a few apps in rails, django (and a little bit of php), and one of the things that I started doing in some of them is storing database and other passwords as environment variables rather than plain text in certain config files (or in settings.py, for django apps).

In discussing this with one of my collaborators, he suggested this is a poor practice - that perhaps this isn't as perfectly secure as it might at first seem.

So, I would like to know - is this a secure practice? Is it more secure to store passwords as plain text in these files (making sure, of course, not to leave these files in public repos or anything)?

Answer

emrass picture emrass · Sep 17, 2012

As mentioned before, both methods do not provide any layer of additional "security" once your system is compromised. I believe that one of the strongest reasons to favor environment variables is version control: I've seen way too many database configurations etc. being accidentially stored in the version control system like GIT for every other developer to see (and whoops! it happened to me as well ...).

Not storing your passwords in files makes it impossible for them to be stored in the version control system.

Related questions

Can Wordpress be replaced by a Framework like Django or Ruby on Rails?

I consider myself a well trained WordPress template developer, and i recently started to read books and documents about web app frameworks, particularly Django and Ruby on Rails. I didn't know any of the two languages, but i have no …

Read More
Anyone using Django in the "Enterprise"

I know that the word “enterprise” gives some people the creeps, but I am curious to know if anyone has experience creating enterprise applications, similar to something like say… Java EE applications, which are highly concurrent, distributed applications with Django? …

Read More
Is there something similar to 'rake routes' in django?

In rails, on can show the active routes with rake (http://guides.rubyonrails.org/routing.html): $ rake routes users GET /users {:controller=>"users", :action=>"index"} formatted_users GET /users.:format {:controller=>"users", :action=>"index"} POST /users {:…

Read More