How to encrypt passwords in configuration files, grails [and java]

Question

I am looking for a step-by-step guide on securing passwords placed in configuration files in grails. This means password security in Config.groovy and DataSource.groovy. There are many Google results that contain bit and chunks of the answer, but do not contain short guides on how to do this. Can someone point me in the right direction? Thanx

Answer 1

For Config.groovy, you can always simply encrypt the password somehow, and then put this hash in Config.groovy manually. When you need to use it in your code, you have code to decrypt it. It doesn't seem that hard.

DataSource.groovy is another animal, however, since it is loaded into the Hibernate API for you. I saw some code like this in interwebs and it seems to be moving in the right direction ...

dataSource { pooled = false driverClassName = "org.hsqldb.jdbcDriver" username = "sa" password = someEncryptionApiObject.decrypt(propertyFile.readProperty("MyPassword")) } 

... where you will encrypt the properties file containing the data you need, and decrypt when necessary.

Answer 2

Question: What do you want to protect your configuration file against? One possibility would be to use file system encryption. Another way is to encrypt the file with a strong password and request a password when starting applications. But note that the application cannot be restarted, and then without re-entering the password!

Check out the Apache httpd documentation to see how Apache deals with the same problem.

Answer 3

Config.groovy and DataSource.groovy are not a configuration file, this is a configuration class. Compiled results are not readable.

Update

Using the obfuscation tool in your configuration classes. Here is a list .