What are your suggestions for storing AWS authentication data?

Question

Scenario: A web application written in PHP uses Amazon Web Service and must store a passkey and secret passkey in order to function. Are there currently recommendations and / or APIs for storing this data securely?

My idea is to encrypt it symmetrically in a file based on a key created from the server’s local variables. Thus, [I hope] nonsense, if someone receives a copy of the file via FTP, he lost the laptop with the copied files, etc. I have a problem: an experienced attacker can simply load his own script to decrypt it.

This seems like a general situation , and I never got a convenient solution. Obviously, I cannot use a one-way hash because I need the source data to create the HMAC to send to AWS. Links to related SO questions are welcome.

Answer 1

Oh. Security issue.

I think the question you should ask here is what you say, for example, mySQL passwords in your php configuration files?

To be honest, I would say that if someone managed to get a copy of your files, then your security needs to be rethought anyway. For my own use, I usually save passwords in only one place (on the server where they should be used), and make sure that I use a randomly generated password each time (insert it into the configuration file and voila!)

To be honest, if this is not your own host, any sensitive data may be compromised.

If this is your own host, I would suggest using the correct permissions on Linux and PHPSuExec to make sure that only scripts that you can write can access the files.

In any case, to answer your original question, your AWS Access / Secret Keys is the same as the MySQL password. Well, he has the potential to allow someone to access your service, but he does not give them access to your personal Details. Even with symmetric encryption, if your script has a security hole, you can access this information.

Simply put, you run the risk when you put these keys in any place accessible to everyone except you. How much do you trust Amazon servers to not be at risk?

My suggestion was to try to add as much security as you can, but keep track of your account, I usually do a cron job to send me an email with changes to my S3 account (new uploaded files, new buckets and etc. etc.), and from this I can say what happens.

There is no simple solution; it is a combination of providing each separate layer of the system. I mean, if you use symmetric encryption, the password for this must be saved somewhere, right? or are you going to enter it every time?

Hope this helps

Answer 2

My idea is to encrypt it symmetrically in a file based on a key created from the server’s local variables. Thus, [I hope] nonsense, if someone receives a copy of the file via FTP, he lost the laptop with the copied files, etc. I have a problem: an experienced attacker can simply load his own script to decrypt it.

This will not hurt, but in the end it is simply security through obscurity, as someone who can read the file can probably also read and reconstruct your code. If you do not enter a password or otherwise provide a secret every time you start the server, encryption will not help. Does it just transfer the problem to a way to protect the encryption key (which should also be accessible to the server)?

You need to harden and design your application and server (do not forget the OS and remote access to the OS) so that no one who is unauthorized can read files in the system in the first place.

If you are worried that someone is gaining physical access to the box, focus on physical security to stop it.

Answer 3

I use symmetric encryption, as you suggest. When I start my server, I need to provide it with a key to decrypt files containing authentication data.

Of course, the hacker could dump the memory and read the password this way, but this is a bit more complicated than reading the cleartext file. There is no perfect solution; security is always a compromise between risk and ease of use.

Thus, server security is still a key issue, but simply the question of how much security is provided. I would suggest looking at Bastille Linux or something similar to simplify your server, but this is another topic altogether.