phpwiki-talk

[Phpwiki-talk] Permissions for index.php -- hide MySQL password?

[Robert D. <rob...@ya...>]

Hello everyone,

I've installed PhpWiki on my project website at SourceForge
and I have to say, it is really terrific! Thanks to the 
development team for a job well done. 

I have a question about the MySQL password. I see that I
can put the admin password in index.php in encrypted form --
that's great. But can I also encrypt the MySQL password?

It seems like a security problem, since index.php must be
readable by the web server; it might be possible for anyone
with a login on the project servers to read the MySQL password.

I've read through archives for PHP, MySQL, and PhpWiki, but
there doesn't seem to be a definitive solution. It seems the
standard operating procedure is to ask the SF sysadmins to
"chgrp nobody index.php". Is there another way?

It may be not so much of an issue, since by design, a wiki
is pretty much wide open for abuse anyway. But it seems
like the MySQL-password-in-a-script problem must be 
generic to many SF projects that use MySQL.

How was this problem solved for the PhpWiki project
demonstration wiki?

Thanks for any light you can shed on this issue --

Robert Dodier

__________________________________
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing.
http://photos.yahoo.com/

Re: [Phpwiki-talk] Permissions for index.php -- hide MySQL password?

[Reini U. <ru...@x-...>]

Robert Dodier schrieb:
> I have a question about the MySQL password. I see that I
> can put the admin password in index.php in encrypted form --
> that's great. But can I also encrypt the MySQL password?

that's unfortunately a mysql architectural problem. their fault.
every perl and php programmer must deal with that solution somehow.

one can read in a local file with the password, which is not in
the web docroot, but it must be passed cleartext to the database.
since php's are normally associated with the php engine, and no one 
local access to the webserver (shell or ftp account), it's quite secure.

for important mysql passwords in php apps, one stores the passwords in a 
secure location. but it must be readable by the apache user, so anyone 
with problematic/erratic php script (there are thousands, I worked for a 
very large ISP) will be able to read it, if he knows where.

> It seems like a security problem, since index.php must be
> readable by the web server; it might be possible for anyone
> with a login on the project servers to read the MySQL password.
> 
> I've read through archives for PHP, MySQL, and PhpWiki, but
> there doesn't seem to be a definitive solution. It seems the
> standard operating procedure is to ask the SF sysadmins to
> "chgrp nobody index.php". Is there another way?
> 
> It may be not so much of an issue, since by design, a wiki
> is pretty much wide open for abuse anyway. But it seems
> like the MySQL-password-in-a-script problem must be 
> generic to many SF projects that use MySQL.

yes, see above.

> How was this problem solved for the PhpWiki project
> demonstration wiki?

password stored plaintext in index.php.
no one without shell account is able to see the content of index.php.
-- 
Reini Urban
http://xarch.tu-graz.ac.at/home/rurban/

[Phpwiki-talk] Various Newbie Questions

[Alexandre E. <aen...@in...>]

Have only done a few things with phpWiki so far but am really impressed 
by it. It's this exact combination of simplicity, convenience, and 
flexibility we so rarely find in commercial programs and make 
open-source so cool.

BTW, I use phpWiki 1.3.6 on an Apple iBook Mac OS X 10.2.8, Apache 
1.3.26, PHP 4.3.0, and MySQL 4.0.14. I'm guessing the most relevant 
part is that I'm running through SQL..

Now, a few questions, as a newbie. Didn't find answers in the obvious 
doc yet. Feel free to respond privately. Sorry if some are too obvious. 
They sound pretty much like feature requests but I don't know if these 
features are already available or not.

So, is there a (simple) way to...

...change a page name/title?

...change a username?

...have a small phpWiki archive hosted for free, somewhere?

...wikify (phpWiki-compatible) external pages from HTML?

...send a specific page to XML and/or zip?

...do a site-wide find and replace?

...make plugin output editable?

...have a "question mark" button default to "?action=edit" instead of 
create?

...add "BackLinks" buttons in the WantedPages?

...quickly make "journal" entries, linked simply by the date?



Sorry if that's a lot. The first two (changing a page name/title and 
changing a username) are the  most important.

Thanks!

Alexandre Enkerli
Ph.D. Candidate
Department of Folklore and Ethnomusicology
Indiana University

Re: [Phpwiki-talk] Permissions for index.php -- hide MySQL password?

[Carsten K. <car...@us...>]

On Monday, December 22, 2003, at 12:10  pm, Reini Urban wrote:

> Robert Dodier schrieb:
>> I have a question about the MySQL password. I see that I
>> can put the admin password in index.php in encrypted form --
>> that's great. But can I also encrypt the MySQL password?
>
> that's unfortunately a mysql architectural problem. their fault.
> every perl and php programmer must deal with that solution somehow.
>
> one can read in a local file with the password, which is not in
> the web docroot, but it must be passed cleartext to the database.
> since php's are normally associated with the php engine, and no one 
> local access to the webserver (shell or ftp account), it's quite 
> secure.
>
> for important mysql passwords in php apps, one stores the passwords in 
> a secure location. but it must be readable by the apache user, so 
> anyone with problematic/erratic php script (there are thousands, I 
> worked for a very large ISP) will be able to read it, if he knows 
> where.
>
>> It seems like a security problem, since index.php must be
>> readable by the web server; it might be possible for anyone
>> with a login on the project servers to read the MySQL password.
>> I've read through archives for PHP, MySQL, and PhpWiki, but
>> there doesn't seem to be a definitive solution. It seems the
>> standard operating procedure is to ask the SF sysadmins to
>> "chgrp nobody index.php". Is there another way?
>> It may be not so much of an issue, since by design, a wiki
>> is pretty much wide open for abuse anyway. But it seems
>> like the MySQL-password-in-a-script problem must be generic to many 
>> SF projects that use MySQL.
>
> yes, see above.
>
>> How was this problem solved for the PhpWiki project
>> demonstration wiki?
>
> password stored plaintext in index.php.
> no one without shell account is able to see the content of index.php.
> -- 
> Reini Urban
> http://xarch.tu-graz.ac.at/home/rurban/

Hi,

I agree with Reini, normally it's not a security issue because usually 
no one has access to the index.php file anyway.

As far as I know, most web-hosts/providers do not even allow direct 
MySQL access from outside their domain anyway, probably only within 
their own localhost(webserver) via php, and not from any external IP 
address.

However, if anyone does figure out how to use an encrypted database 
password in PhpWiki's index.php, I'm sure such a modification would be 
welcome.

Carsten

Re: [Phpwiki-talk] Permissions for index.php -- hide MySQL password?

[Bishop <bi...@pl...>]

>
> On Monday, December 22, 2003, at 12:10  pm, Reini Urban wrote:
>
>> Robert Dodier schrieb:
>>> I have a question about the MySQL password. I see that I
>>> can put the admin password in index.php in encrypted form --
>>> that's great. But can I also encrypt the MySQL password?
>>
>> that's unfortunately a mysql architectural problem. their fault.
>> every perl and php programmer must deal with that solution somehow.
>>
>> one can read in a local file with the password, which is not in
>> the web docroot, but it must be passed cleartext to the database.
>> since php's are normally associated with the php engine, and no one
>> local access to the webserver (shell or ftp account), it's quite
>> secure.
>>
>> for important mysql passwords in php apps, one stores the passwords in
>> a secure location. but it must be readable by the apache user, so
>> anyone with problematic/erratic php script (there are thousands, I
>> worked for a very large ISP) will be able to read it, if he knows
>> where.
>>
>>> It seems like a security problem, since index.php must be
>>> readable by the web server; it might be possible for anyone
>>> with a login on the project servers to read the MySQL password.
>>> I've read through archives for PHP, MySQL, and PhpWiki, but
>>> there doesn't seem to be a definitive solution. It seems the
>>> standard operating procedure is to ask the SF sysadmins to
>>> "chgrp nobody index.php". Is there another way?
>>> It may be not so much of an issue, since by design, a wiki
>>> is pretty much wide open for abuse anyway. But it seems
>>> like the MySQL-password-in-a-script problem must be generic to many
>>> SF projects that use MySQL.
>>
>> yes, see above.
>>
>>> How was this problem solved for the PhpWiki project
>>> demonstration wiki?
>>
>> password stored plaintext in index.php.
>> no one without shell account is able to see the content of index.php.
>> --
>> Reini Urban
>> http://xarch.tu-graz.ac.at/home/rurban/
>
> Hi,
>
> I agree with Reini, normally it's not a security issue because usually
> no one has access to the index.php file anyway.
>
> As far as I know, most web-hosts/providers do not even allow direct
> MySQL access from outside their domain anyway, probably only within
> their own localhost(webserver) via php, and not from any external IP
> address.

So, if you store your virtualhost www files in cvs, or plan to, make sure
the index.php (or wiki) file doesn't contain any db password stuff!

(or don't store it in the same place with the viewcvs, or put that one
file or a dbpwd.php inclusion file into the .cvsignore)

 - bish
cvs update -D 1994 bishop/life

Re: [Phpwiki-talk] Permissions for index.php -- hide MySQL password?

[Reini U. <ru...@x-...>]

Carsten Klapp schrieb:
> On Monday, December 22, 2003, at 12:10  pm, Reini Urban wrote:
>> that's unfortunately a mysql architectural problem. their fault.
>> every perl and php programmer must deal with that solution somehow.
>>
>> one can read in a local file with the password, which is not in
>> the web docroot, but it must be passed cleartext to the database.
>> since php's are normally associated with the php engine, and no one 
>> local access to the webserver (shell or ftp account), it's quite secure.
>>
>> for important mysql passwords in php apps, one stores the passwords in 
>> a secure location. but it must be readable by the apache user, so 
>> anyone with problematic/erratic php script (there are thousands, I 
>> worked for a very large ISP) will be able to read it, if he knows where.
>>
>>> It seems like a security problem, since index.php must be
>>> readable by the web server; it might be possible for anyone
>>> with a login on the project servers to read the MySQL password.
>>> I've read through archives for PHP, MySQL, and PhpWiki, but
>>> there doesn't seem to be a definitive solution. It seems the
>>> standard operating procedure is to ask the SF sysadmins to
>>> "chgrp nobody index.php". Is there another way?
>>> It may be not so much of an issue, since by design, a wiki
>>> is pretty much wide open for abuse anyway. But it seems
>>> like the MySQL-password-in-a-script problem must be generic to many 
>>> SF projects that use MySQL.
>>
>> yes, see above.
>>
>>> How was this problem solved for the PhpWiki project
>>> demonstration wiki?
>>
>> password stored plaintext in index.php.
>> no one without shell account is able to see the content of index.php.

> However, if anyone does figure out how to use an encrypted database 
> password in PhpWiki's index.php, I'm sure such a modification would be 
> welcome.

as I explained this is impossible.
mysql_connect() expects the password to be plaintext.
see http://www.mysql.com/doc/en/mysql_real_connect.html
http://www.mysql.com/doc/en/Password_security.html and
http://www.mysql.com/doc/en/Secure_connections.html

Mysql supports SSL since 4.0.0, but(!) you have to compile your own 
client and server. and it's quite slow since it encrypts the whole 
protocol data exchange, not only auth.


BTW: MySQL 5.0.0alpha came out right now. nice christmas present.
stored procedures finally, as already presented at the last mysql 
conference.
-- 
Reini Urban
http://xarch.tu-graz.ac.at/home/rurban/