I am trying to secure a PHP web application which runs out of a WAMP-style local installation.
Currently, passwords for the app's database are just in the .php files. I thought about encrypting them, but any person can just step through the code to decrypt them pretty easily.
This does not run on a web server, it runs on the user's PC. Has anyone here attempted to secure this type of application, and perhaps shipped a compiled program to return the passwords, or perhaps used an external keystore somehow?
Your thoughts are appreciated.
Clarification: The database is also on the local PC.
There are a LOT of very robust external authentication providers out there. Firebase and OAuth to name a few. Technically speaking, no system is 100% hack-proof, but Firebase and OAuth provide would-be hackers a tough road to success
You can use ENV variable in that case make .env file and store password in that and call the same in application.
You can create environment variable in Apache config file and call from there in your application this is more secure.
There is no way to protect a database connection credentials if you are giving the client / user the source code. Basically if your app can access it and the source code is there for them to use, read, parse then they have the same access as the software does.
Related
Be Clear: This question is not about password encryption/hashing to save into database.
I have developed a PHP application for a client. The application is installed on client machine with XAMPP (placed at htdocs/project_name). Client uses that application locally but the local database is synchronized with remote MYSQL database by Export Report button available on web interface.
My concern is when I store a connection string for remote database in my PHP code the username & password are visible to any guys who can hunt PHP script file and can see it. I don't even wish the client be able to view passwords used for remote connection/synchronization.
How can I achieve this?
You want to give user permission (login data) to connect to the
database but at the same time don't give him permission (login data).
The only thing that is on my mind to store login data corrupted,
and in code decrypt this data with some key hardcoded in the script. This is hackable,
but if the user is not programmed it is unlikely to do this
If you accept Kerckchoff's principle then it is impossible to provide an authentication which is available to a program run by a user without making that token available to the user. If you provided a better description of the problem, specifically the modes of operation you are trying to prevent then we might be able to provide effective solutions (e.g. encapsulating all data access in packages would restrict access to data for specific users).
I'm new to this so please be gentle with me!
I have a PHP login page which connects to a MYSQL table (users) for validation
I need a username and password to initially access the table. eg:
$con = mysqli_connect('localhost','masteruser','masteruserpassword,'users');
Is it safe to keep the username and password coded in the PHP file. I'm thinking it is because the PHP file will never be 'served' only executed.
Any tips please
PHP code is executed on server So no need to worry about this.
Only processed output from the php code is delivered to the client side in form of response in html and js.
It's totally safe. But it will be much better, if you move it to config file
It's safe unless somebody reach your server.
For what it's worth, WordPress works this way. The database access credentials are in plain text in a file called wp-config.php in the installation's root directory. WordPress is probably the most widely deployed MySQL based web app there is. So you should be OK. WordPress seems to be working fine. :-)
BUT: practice defense in depth. Create a special MySQL account for your web app, and restrict its privileges to the MySQL database (or databases) your web app needs. Don't put a MySQL administrative account in there.
Also, make sure that account is restricted so attempts to connect from machines other than your web host will fail.
Thirdly, try to use a MySQL server machine that's behind a firewall, and only accessible to other machines in the same data center.
Finally, keep routine backups.
If you're using a typical commercial shared hosting service they take care of most of this for you (maybe not the backups).
That way, if somebody does manage to crack your server and look at your password, they'll have a hard time making use of it, and if they do make use of it they won't be able to damage much. If they do damage your app, you'll be able to restore it from backup.
I need to store thousands of PDFs on a web-server which need to be secured (encrypted or access permission based?).
I want the only way to access these files to be via an iPhone app which I'm currently making, which is username/password protected. (I usually use php to communicate from the app to the database/files)
Which technologies should I use to protect the files in the first place?
What iOS/php code/frameworks should I use to display them on the device?
Do I need to encrypt the transfer, over ssl or something?
Thanks in advance, Leigh
If those PDF files contains sensitive information you should encrypt them using an unbreakable encryption algorithm, such as AES-256, use mcrypt for symmetric encryption (see php.net/mcrypt).
I would recommend you to popup the default PDF reader of iOS, that would be the most easy way to do it.
Again, if those file are super sensitive or something - Of course, use SSL/TLS. It is recommended to use it anyway.
To display the PDF on your app, you can use UIDocumentInteractionController. See Document Interaction Programming Topics for iOS. Something like:
NSURL *url = ... // the file URL for the PDF
UIDocumentInteractionController *controller = [UIDocumentInteractionController interactionControllerWithURL:url];
controller.delegate = self;
[controller presentPreviewAnimated:YES];
Clearly, you have to specify your view controller as conforming to the UIDocumentInteractionControllerDelegate protocol, and, at the very least, implement the documentInteractionControllerViewControllerForPreview:
- (UIViewController *) documentInteractionControllerViewControllerForPreview: (UIDocumentInteractionController *) controller
{
return self;
}
You can also view PDFs in a UIWebView, but the document interaction controller is probably better.
To encrypt the transfer, you should employ SSL (e.g. use HTTPS instead of HTTP). You obviously should also make sure that you never send/store the password in the clear.
In terms of protecting the files on the server, at the very least make sure that they're not accessible without going through some authorization process. That is, don't just put the files on the web server and then reply upon some application level security to retrieve the URLs. Store the files elsewhere outside the web server's root and control access to the files through your secure web interface. Always assume your URLs can be compromised. Depending upon the level of security required, you might also want to encrypt the files on the server and have the app decrypt them.
For general security concerns, I might suggest checking out WWDC 2012 video The Security Framework. Or WWDC 2011 videos Security Overview and Securing Application Data. Also see the Security Starting Point for iOS document.
I am developing a web application for my university project this summer and I am looking for some advice, The web application is to be deployed in to a windows environment that has around 500 users. The users will need to login before they can access the web application, this is where my first problem appears.
Do I need a way to export the users from active directory with their passwords on a daily basis. However I know that passwords are stored as a hash not clear text so id have to mimic the hashing in my web app. So do I use LDAP to authenticate the users for me? I would appreciate some advice of maybe a link to a resource that anyone knows that would be worth me reading.
Note.
The web application will be made in PHP with a sql database running on a windows server inside the same domain.
Thanks
PHP has an LDAP module that allows you to interface the Active Directory without exporting it.
Here is an example of implementing an LDAP authentication through php:
http://code.activestate.com/recipes/101525-ldap-authentication/
Since PHP has libraries to assist you with interacting with LDAP already then that might be the way to go. Exporting and managing users yourself sounds like reinventing the wheel.
Just contact the auth server using PHP::LDAP. This blog post shows a good example.
I have a website developed in PHP. There are 2 classes (in 2 seperate php files) that contain the siteadmin's gmail user id and password (in plain text) and database password (again in plain text). Though none of these classes are displayed on the browser ( like index.php). These files contain only php classes and no html code and the references to those plain text passwords is only through objects of those classes.
Off late, I have started to wonder if this is secure enough? I have tried my best (acting as a malicious person) to try and read the contents of the two said php files but was not able to do so. I am not very conversant with developing secure code, so not sure what should be my approach to make sure that these passwords never get exposed.
Could any one please suggest best practices to develop php code that can contain such sensitive information securely.
Put configurable items in a separate configuration file, above your public web directory
Make sure you have set correct file permissions to your files
Check your web application for local (and remote) file inclusion
Have your server up-to-date
Having your passwords at a safe spot is not the complete solution, you'll need to have your complete PHP application secure, and nobody unauthorized should be able to get root/administrator access to the server.
Firstly, I'd look at using OAuth for accessing GMail if at all possible - it means you don't have to store credentials at all, and provides some level of protection in case your server does get compromised.
I would also look at the answers to this question.
Finally, if your site is on the public internet, it's worth reading up on at least the basics of internet security, and especially securing web applications. There are all sorts of ways things can go wrong. I like the "hacking exposed" books.
Don't store passwords in files, because someone will eventually check that file into source control. Or someone will set a permission incorrectly.
Run the application with its own O/S user account
Put the passwords in an O/S environment variable for the application user (not a system environment variable)