Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I use wordpress and other CMS's and all these have plain text passwords in their config files e.g. in wp-config.php

I wonder is this the normal way an administrator would protect security?

I realise its possible to move the wp-config outside of the root web directory, but still if the server itself is compromised, its possible to find the wp-config file and the password inside, then the system is comprimised.

Is there a way to encrypt all passwords on the system, so that in the web applications config files it uses the encrypted pass and not just plain text? Is there a sensible way of keeping plain-text passwords off the server?

PS i use linux vps ubuntu servers

Cheers Ke

share|improve this question
2  
The only way somebody could read that (Short of a series of unlikely failures preventing the server from parsing the .php file and thus just serving it up as plaintext) is if they had your FTP details. If they have your ftp details, you have far bigger problems. –  Phoshi Mar 20 '10 at 14:08
    
The normal way a wordpress admin or a more general admin would protect security? As a general rule, you encrypt passwords, but not all applications support that. –  David Thornley Mar 20 '10 at 15:42
add comment

2 Answers 2

up vote 2 down vote accepted

I've never seen or heard of the password in wp-config.php being encrypted .

I think you should take a look this Securing wp-config.php guide. Instead of encrypting the password from WP-Config, you can protect the profile in other ways however it’s almost impossible to view php files from remote, you should have access to ftp to do that.

share|improve this answer
add comment

Is there a way to encrypt all passwords on the system, so that in the web applications config files it uses the encrypted pass and not just plain text?

Maybe. But what's the point of that? The web application needs a way to decrypt it - and if it can do that, there's nothing to stop $RANDOM_CRACKER from doing the same.

...as Phoshi said in a comment, if $RANDOM_CRACKER gains access to your config file, you have bigger problems anyway.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.