1

I use wordpress and other CMS's and all these have plain text passwords in their config files e.g. in wp-config.php

I wonder is this the normal way an administrator would protect security?

I realise its possible to move the wp-config outside of the root web directory, but still if the server itself is compromised, its possible to find the wp-config file and the password inside, then the system is comprimised.

Is there a way to encrypt all passwords on the system, so that in the web applications config files it uses the encrypted pass and not just plain text? Is there a sensible way of keeping plain-text passwords off the server?

PS i use linux vps ubuntu servers

Cheers Ke

2
  • 2
    The only way somebody could read that (Short of a series of unlikely failures preventing the server from parsing the .php file and thus just serving it up as plaintext) is if they had your FTP details. If they have your ftp details, you have far bigger problems.
    – Phoshi
    Mar 20, 2010 at 14:08
  • The normal way a wordpress admin or a more general admin would protect security? As a general rule, you encrypt passwords, but not all applications support that. Mar 20, 2010 at 15:42

2 Answers 2

2

I've never seen or heard of the password in wp-config.php being encrypted .

I think you should take a look this Securing wp-config.php guide. Instead of encrypting the password from WP-Config, you can protect the profile in other ways however it’s almost impossible to view php files from remote, you should have access to ftp to do that.

1

Is there a way to encrypt all passwords on the system, so that in the web applications config files it uses the encrypted pass and not just plain text?

Maybe. But what's the point of that? The web application needs a way to decrypt it - and if it can do that, there's nothing to stop $RANDOM_CRACKER from doing the same.

...as Phoshi said in a comment, if $RANDOM_CRACKER gains access to your config file, you have bigger problems anyway.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .