如何避免在版本控制中存储密码? [英] How do you avoid storing passwords in version control?

问题描述

您使用什么策略来避免在版本控制中存储密码?

当前，我将开发/测试/生产密码保存在三个不同的文件中，并且在部署过程中使用了适当的文件.所有这些都致力于版本控制，但是我并不是很满意，因为并不是所有的开发人员都需要知道这些密码(尤其是外包的密码，只有在他们的项目持续进行时才可以访问，这可能只有一个月).

在数据库中存储密码不是一个好选择:

• 在Spring上下文(Java应用程序)初始化期间，我需要大多数数据，并且我不想构建用于连接到单个数据库的支架，然后再连接到其余数据库并初始化其余的应用程序
• 某些密码仅与部署相关；访问不同服务器，密钥库等的密码；这些是应用程序启动后无法加载的东西，因为它根本无法加载

我正在考虑将部署配置从开发人员机器移至专用计算机，以从版本控制中签出代码并运行构建/部署脚本，但我不确定如何做到这一点.

我还需要说一句我不想要最终的安全性:我只是想避免在每个开发人员的磁盘上都设置密码，并且使其变得太简单了.

因此，我正在询问您的经验/最佳做法.你如何做到的?

解决方案

特定于环境的配置属性我倾向于放置一个属性文件，该文件不在源代码管理中，也不在构建过程中.设置新环境时，该设置的一部分是创建该属性文件，其中包括数据库地址，凭据和名称，相关远程主机的名称等内容.

在Spring中，您使用包装器来运行应用程序服务器和JVM启动选项包括将这些属性文件添加到类路径中，以便Spring可以找到它们.

What strategy do you use to avoid storing passwords in version control?

Currently, I have development/test/production passwords saved in three different files and the appropriate file gets used during deployment. All this is committed to version control, but I'm not too happy with that since not all developers need to know those passwords (especially outsourced ones, which have access only while their projects last, which could be only a month).

Storing passwords in database is not a great option:

• I need most of the data during the initialization of Spring context (Java app), and I don't want to build scaffolding for connecting to a single database, and afterwards connecting to the rest of databases and initializing the rest of application
• some of the passwords are only deployment-related; password to access different servers, keystores, etc.; those are the things application can't load after it starts, since it doesn't load it at all

I'm thinking about moving deployment configuration from developer machine to dedicated computer which checks out code from version control and runs build/deployment script, but I'm not really sure what would be the best way to do it.

I also need to say that I don't want ultimate security: I just want to avoid having passwords on every developer's disk and making it too easy.

So I'm asking for your experiences/best practices. How do you do it?

解决方案

Environment-specific configuration properties I tend to put in, say, a properties file that isn't in source control and isn't part of the build process. When setting up a new environment, part of that setup is to put create that properties file that includes things like database addresses, credentials and names, names of relevant remote hosts and so on.

In Spring you use the PropertyPlaceholderConfigurer to load the properties file. It just needs to be findable by Spring, which usually just means putting it in an appropriate directory under the application server.

Alternatively, you use wrapper to run the application server and the JVM startup options include adding these properties files to the classpath so Spring can find them.

这篇关于如何避免在版本控制中存储密码?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！