How to encrypt password ?

[harsh288]

How to encrypt the password, because of security reasons we can't keep in a text file

host rdb_host
  database rdb_database
  adapter mysql2_or_postgresql_or_etc
  username myusername
  password mypassword

[kenhys]

How about using https://docs.fluentd.org/quickstart/faq#how-can-i-use-environment-variables-to-configure-parameters-dynamically?

[harsh288]

Hello @kenhys Sorry for replying late, I thought this is a dead forum, wasn't expecting any reply over here, the environment is the last option to me but still, it is a security threat.

Also one more issue I faced recently was if you specify a host like hostName/sqlInstanceName it doesn't work, in one server there is a possibility of having more than one server instances.

@repeatedly @kenhys @frsyuki @cosmo0920 @ashie @ganmacs

[harsh288]

@kenhys

Can we write some custom encryption logic inside
fluent-plugin-sql for the password where the password will be in an encrypted format in the config file and the custom logic will decrypt first and then it will pass it to the SQL DB.

[harsh288]

Hello @repeatedly @kenhys @frsyuki @cosmo0920 @ashie @ganmacs

Can you please help, this is such a big security loophole.

[harsh288]

@kenhys Do we have any working solution? This issue has been escalated so need some workaround ASAP.

[ashie]

Generally speaking, encrypting the password here doesn't make sense.
You should set the permission of reading the config file only for the file owner.
Even when encryption is implemented, if an attacker can read the file, the attacker will be also able to decrypt the password same way with the fluentd process. This is the why no one reply to your question.

Writing plain text credentials in the config file isn't fluent-plugin-sql specific, most application use same way such as Rails applications.

If you have a special reason that you are able to make the encryption meaningful, please describe it.
For example, if entering password manually is allowed on every starting your Fluentd process, encrypting the credentials make sense.

[harsh288]

@ashie Yes we do have to enter the password manually at every start of the Fluentd process, more than that, for us, no matter if it is a system password, DB password, or any other passwords, it can't be in plain text, that is our company security policy, we don't care about attackers right now or any other scenario you described, it just that it has to be encrypted, so I request you to please help me with a possible solution as soon as possible.

[ashie]

Rails 5.2 or later supports encrypted credentials by ActiveSupport::EncryptedConfiguration.
(A master key is required even though using it.)

We might be able to introduce similar feature if its really required by many users.

[harsh288]

@ashie Request you to please introduce that.

[KairenP]

I was under the impression this feature would be available, I started browsing for some syntax to enable encryption and unfortunately I didn't find anything so when I checked the code it was completely missing.

I upvote for this feature, can we have in next version soon?