View source for Manual:Securing database passwords

<languages />
<translate><!--T:1--> <tvar name=1>{{ll|Manual:LocalSettings.php|LocalSettings.php}}</tvar> by default contains MySQL database user IDs and passwords.</translate> 
<translate><!--T:2--> Keeping these credentials in LocalSettings.php is risky, because under rare conditions PHP files can be served as plain text revealing these credentials to the world:</translate>

<translate>
<!--T:3-->
*PHP is disabled on the server</translate>
<translate>
<!--T:4-->
*PHP itself breaks</translate>
<translate>
<!--T:5-->
*You have CGI search.pl (a common CGI search script) anywhere in that domain. [http://www.securityspace.com/smysecure/catid.html?id=10627 Description of exploit.]</translate>

<translate>
<!--T:6-->
If in these rare cases you want to keep your MySQL username and password a secret, they should not be part of the LocalSettings.php file.

== MySQL Passwords Outside Of Webroot == <!--T:7-->
</translate>
<translate><!--T:8--> You should never put your MySQL passwords in a text file that is within the web root.</translate> 
<translate><!--T:9--> You can avoid doing so by doing this:</translate>

* <translate><!--T:10--> Make a directory outside your web root.</translate> <translate><!--T:11--> For example, if your website is located at "<tvar name=1><code>/htdocs/www-wiki</code></tvar>", then make a directory called "<tvar name=2>external_includes</tvar>" outside of your webroot:</translate>
** {{Code| mkdir /external_includes | lang = bash| inline=yes}}
* <translate><!--T:13--> Create a file in the directory you just made called something like "mysql_pw.php" and place a variable on a separate line for each of your mysql user name, password, hostname, and database name, each variable being set to the real values.</translate> <translate><!--T:14--> For example, using [[w:GNU nano|nano]] as your editor:</translate>
** {{Code|nano /external_includes/mysql_pw.php | lang = bash | inline = yes }}
** <translate><!--T:16--> Type the following lines using the real values of course in place of the bracketed "mysql_" fillers:</translate>

<syntaxhighlight lang="php">
<?php
  $wgDBserver = "[mysql_host]";
  $wgDBname = "[mysql_db_name]";
  $wgDBuser = "[mysql_user]";
  $wgDBpassword = "[mysql_password]";
  
  // more confidential data...
?>
</syntaxhighlight>

:* <translate><!--T:17--> Take care to leave no whitespace (blank lines) after the text.</translate>
:* <translate><!--T:18--> Save and close the file.</translate> <translate><!--T:19--> In [[w:GNU nano|nano]] this is: <tvar name=1>{{Key press|Ctr|O}}</tvar> (save) and <tvar name=2>{{Key press|Ctr|X}}</tvar> (close)</translate>

{{anchor|chgrp}}
<translate><!--T:20--> Check with your distro for the webserver's user. This varies, and examples include "apache", "www-data", "nobody", "httpd".</translate> 
<translate><!--T:21--> Then set the permissions for the password file like so:</translate>

* {{Code|inline=y|lang=bash| chgrp apache mysql_pw.php}}
* {{Code|inline=y|lang=bash| chmod 640 mysql_pw.php}} <translate><!--T:22--> (removes the access-rights from others and write-rights from webserver)</translate>
* <translate><!--T:23--> (probably repeat with g-rxw ... for LocalSettings.php )</translate>
* <translate><!--T:24--> Make sure that the file owner has <tvar name=1><code>r</code></tvar> (or <tvar name=2>{{Code|inline=y|lang=bash| chmod 400 LocalSettings.php}}</tvar>)</translate>

<translate>
<!--T:25-->
*Edit your LocalSettings.php file and add the following line in the beginning of the file:
</translate>

<syntaxhighlight lang="php">
require_once "/external_includes/mysql_pw.php"; //require_once "[FULL ABSOLUTE PATH TO mysql_pw.php]";
</syntaxhighlight>

<translate>
<!--T:26-->
*Now remove these variables from LocalSettings.php:
</translate>

<pre>
$wgDBserver
$wgDBname
$wgDBuser
$wgDBpassword
</pre>

<translate><!--T:27--> This way if somebody is able to access and display LocalSettings.php, all they will see is some settings rather than the password, username, etc. to your MySQL database and the real file containing that information is off limits to the web server.</translate> 
<translate><!--T:28--> You still need to make sure LocalSettings.php is only readonly to the apache user as described above.</translate>

{{Note|1=<translate><!--T:30--> If you are doing these changes and do not have access to the users because your web server provider does not let you, then, from ftp the minimum rights you have to set for your "<tvar name=1>external_includes</tvar>"  are: <tvar name=2><code>drwx--x--x</code></tvar> (711).</translate> <translate><!--T:31--> For the file "<tvar name=1>mysql_pw.php</tvar>" you will have to set <tvar name=2><code>rw-r--r--</code></tvar> (644), otherwise your wiki will not run.</translate> <translate><!--T:32--> Still, your password is secure because the file with critical info is out of web access.</translate>}}

{{note|1=<translate><!--T:33--> If you can't create any files outside of your webroot, you can still achieve some protection by going through the process above and using a filename like "<tvar name=1>.htdbpasswd</tvar>" inside your webroot instead of "<tvar name=2>mysql_pw.php</tvar>", as most webservers are configured to deny access to any files beginning with <tvar name=3>.ht*</tvar></translate>}}

<translate>
== See also == <!--T:34-->
</translate>
* <translate><!--T:35--> The setting <tvar name=1>{{ll|Manual:$wgSMTP|$wgSMTP}}</tvar> for sending emails contains user name and password.</translate> <translate><!--T:36--> It can be secured in the same way</translate>

[[Category:Security{{#translation:}}|Securing database passwords]]