PostgreSQL - storing db credentials in Apache2 httpd.conf

Question

I have a PHP application that needs to connect to a Postgres database and I don't want to store the credentials in a config file outside the web tree, if I can help it. I installed the pgsql module.

I read this SO post and like the idea of putting them in httpd.conf

I was wondering if anyone has figured out a way to store PostgreSQL db credentials in httpd.conf.

There are no predefined php.ini directives for PostgreSQL PHP module like there are for MySQL PHP module, as far as I can tell:

http://php.net/manual/en/ini.list.php

php_value mysql.default.user      myusername
php_value mysql.default.password  mypassword
php_value mysql.default.host      server

Thanks

I'm not aware that such options exist for PostgreSQL. What exactly are your objections against storing the settings in a config-file? Imo storing them inside php_value settings may even be more dangerous, not sure, but will they be output by phpinfo()? If you don't want to store credentials at-all, it's possible to set a 'trust' authentication for a user from the local machine, this way a local user doesn't have to provide a password (postgresql.org/docs/current/static/auth-methods.html). — thaJeztah
– thaJeztah, Commented Jan 28, 2013 at 19:39
As long as you don't set them as server environment variables, they won't show up in php.ini so I think I'm OK there. This is a remote connection so not sure if Postgres trusted auth would work. — Slinky
– Slinky, Commented Jan 28, 2013 at 19:42
Trusted connections are possible from a remote server and can be specified for a certain user and host/ip-address, however SSL Certificate authentication may be more appropriate in that case — thaJeztah
– thaJeztah, Commented Jan 28, 2013 at 19:49
I just tested setting the mysql.default_ settings in my php.ini and they DO appear in phpinfo() output: jsfiddle.net/MTPy9 ok, phpinfo() should never be present on your website, but still — thaJeztah
– thaJeztah, Commented Jan 28, 2013 at 19:58

Chris Travers · Accepted Answer · 2013-04-23 06:00:49Z

0

You have a few options here.

The best option, if you can do it, is to use certificate auth and a client certificate.
The second best option if you can is to use a .pgpass file, which would store this in the home directory of the user that Apache runs as.
Your third option is you could use mod_rewrite to set the PGUSER and PGPASSWORD environment variables. Note that this is pretty dangerous because anyone on the server could access the environment and learn the username and password.

answered Apr 23, 2013 at 6:00

Chris Travers

26.6k6 gold badges70 silver badges191 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PostgreSQL - storing db credentials in Apache2 httpd.conf

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related