保护属性文件中的密码 [英] Securing a password in a properties file

问题描述

我有一个连接到数据库的java应用程序。

数据库的用户名和密码存储在属性文件中。

要避免的常见做法是什么在属性文件中以明文形式存储密码，同时仍然保留让用户更改密码的选项？

这里的主要动机是防止有人在管理员编辑时查看管理员的肩膀并看到密码属性文件。

我在

Jasypt提供 org.jasypt.properties.EncryptableProperties 类，用于加载，管理和透明地解密.properties文件中的加密值，允许混合使用加密值和未加密值。相同的文件。

http ：//www.jasypt.org/encrypting-configuration.html

使用org.jasypt.properties.EncryptableProperties对象，
应用程序将能够正确读取和使用.prop erties文件
是这样的：

  datasource.driver = com.mysql.jdbc .Driver 
 datasource.url = jdbc：mysql：// localhost / reportsdb 
 datasource.username = reportsUser 
 datasource.password = ENC（G6N718UuyPE5bHyWKyuLQSm02auQPUtm）
  

注意
数据库密码是加密的（事实上，任何其他属性也可以
加密，是否与数据库配置有关）。

我们如何读取这个值？像这样：

  / * 
 *首先，创建（或询问其他人）组件for）
 *的足够加密器解密我们的.properties文件中的值。 
 * / 
 StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor（）; 
 encryptor.setPassword（jasypt）; //可以从web获得，env变量... 
 / * 
 *创建我们的EncryptableProperties对象并以通常的方式加载它。 
 * / 
属性props = new EncryptableProperties（encryptor）; 
 props.load（new FileInputStream（/ path / to / my / configuration.properties））; 
 
 / * 
 *要获得非加密值，我们只需使用getProperty ... 
 * / 
 String datasourceUsername = props.getProperty（ datasource.username）; 
 
 / * 
 * ...并且为了得到加密值，我们做同样的事情。解密将
 *在幕后透明地执行。 
 * / 
 String datasourcePassword = props.getProperty（datasource.password）; 
 
 //从现在开始，datasourcePassword等于reports_passwd... 
  

I have a java application that connects to a database.
The user name and password for the database are stored in a properties file.
What is the common practice to avoid storing the password in cleartext in the properties file while still retaining the option to let the user change it?
The main motivation here is to prevent someone looking over the admin's shoulder and seeing the password while the admin is editing the properties file.
I read here that there's a built in way to do it in C#.
Knowing java, I don't expect to find a built in solution but I'd like to hear what other people are doing.
If I don't find any good choice then I am probably going to encrypt it with a constant password that will be kept in the code. But I'd hate to do it this way because it feels wrong.

Edit Dec 12th 2012 Looks like there is no magic and I must store the password in the code or something similar. At the end we implemented something very similar to what Jasypt that was mentioned in one of the answers does. So I'm accepting the Jasypt answer because it is the closest thing to a definite answer.

解决方案

Jasypt provides the org.jasypt.properties.EncryptableProperties class for loading, managing and transparently decrypting encrypted values in .properties files, allowing the mix of both encrypted and not-encrypted values in the same file.

http://www.jasypt.org/encrypting-configuration.html

By using an org.jasypt.properties.EncryptableProperties object, an application would be able to correctly read and use a .properties file like this:

datasource.driver=com.mysql.jdbc.Driver 
datasource.url=jdbc:mysql://localhost/reportsdb 
datasource.username=reportsUser 
datasource.password=ENC(G6N718UuyPE5bHyWKyuLQSm02auQPUtm) 

Note that the database password is encrypted (in fact, any other property could also be encrypted, be it related with database configuration or not).

How do we read this value? like this:

/*
* First, create (or ask some other component for) the adequate encryptor for   
* decrypting the values in our .properties file.   
*/  
StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();     
encryptor.setPassword("jasypt"); // could be got from web, env variable...    
/*   
* Create our EncryptableProperties object and load it the usual way.   
*/  
Properties props = new EncryptableProperties(encryptor);  
props.load(new FileInputStream("/path/to/my/configuration.properties"));

/*   
* To get a non-encrypted value, we just get it with getProperty...   
*/  
String datasourceUsername = props.getProperty("datasource.username");

/*   
* ...and to get an encrypted value, we do exactly the same. Decryption will   
* be transparently performed behind the scenes.   
*/ 
String datasourcePassword = props.getProperty("datasource.password");

 // From now on, datasourcePassword equals "reports_passwd"...

这篇关于保护属性文件中的密码的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！