Is there a way to use encrypted passwords for db-users, ldap-bind-user and others in resources.ini or is a solution planned for this? Actually the user and group running the webserver for icingaweb2 can read the file resources.ini.
I use icinga on linux.
That’s actually the case for most web based software.
Encrypting the strings may seem obvious, but in the end the process reading the unencrypted password would be the same as the one to decrypt it. If an attacker compromises the web server process he will be able to do the decryption just as well.
What this means is:
the only layer an encrypted password would protect in log term, is an external backup but in that case an encrypted backup would solve that issue too.
Imagine you would have an encryption for resource`s passwords and the web server user has to read the key to encrypt the database password in order to read the database.
If your webserver user get compromised the attacker can get the encryption key which must be accessible by the webserver user anyway.
You need to trust or review modules you install, because every module is “run” by the webserver user and has to have the possibility to access resources and the icingaweb2 config files.
Thank you for your comments.
Encrypted passwords would be protected from a user, that has access to the server. But you are right, when he can read the password file, he must have access to the webserver user and when he has access to this user, he can probably quite easy get the passwords even if they are encrypted in the file. So, we first have to prevent the webserver and the webserver user to be compromised.