<p>Within Ruby on Rails applications database.yml is a plain text file that stores database credentials.</p>

<p>When I deploy my Rails applications I have an after deploy callback in my Capistrano 
recipe that creates a symbolic link within the application's /config directory to the database.yml file. The file itself is stored in a separate directory that's outside the standard Capistrano /releases directory structure. I chmod 400 the file so it's only readable by the user who created it.</p>

<ul>
<li>Is this sufficient to lock it down? If not, what else do you do?</li>
<li>Is anyone encrypting their database.yml files?</li>
</ul>

[{'answer_id': 18344, 'author': 'James A. Rosen', 'author_id': 1190, 'author_profile': 'https://Stackoverflow.com/users/1190', 'pm_score': 5, 'selected': True, 'text': "<p>You'll also want to make sure that your SSH system is well secured to prevent people from logging in <em>as</em> your Capistrano bot.  I'd suggest restricting access to password-protected key pairs.</p>\n\n<p>Encrypting the .yml file on the server is useless since you have to give the bot the key, which would be stored . . . on the same server.  Encrypting it on your machine is probably a good idea.  Capistrano can decrypt it before sending.</p>\n"}, {'answer_id': 247466, 'author': 'Micah', 'author_id': 19964, 'author_profile': 'https://Stackoverflow.com/users/19964', 'pm_score': 1, 'selected': False, 'text': "<p>If you're very concerned about security of the yml file, I have to ask: Is it stored in your version control?  If so, that's another point where an attacker can get at it.  If you're doing checkout/checkin over non-SSL, someone could intercept it.</p>\n\n<p>Also, with some version control (svn, for exampl), even if you remove it, it's still there in the history.  So, even if you removed it at some point in the past, it's still a good idea to change the passwords.</p>\n"}, {'answer_id': 907592, 'author': 'Peter Stuifzand', 'author_id': 1633, 'author_profile': 'https://Stackoverflow.com/users/1633', 'pm_score': 2, 'selected': False, 'text': '<p>Even if you secure the database.yml file, people can still write that uses the same credentials if they can change the code of your application.</p>\n\n<p>An other way to look at this is: does the web application have to much access to the database. If true lower the permissions. Give just enough permissions to the application. This way an attacker can only do what the web application would be able to do.</p>\n'}, {'answer_id': 1001484, 'author': 'Olly', 'author_id': 1174, 'author_profile': 'https://Stackoverflow.com/users/1174', 'pm_score': 5, 'selected': False, 'text': '<p>The way I have tackled this is to put the database password in a file with read permissions only for the user I run my application as.  Then, in database.yml I use ERB to read the file:</p>\n\n<pre><code>production:\n  adapter: mysql\n  database: my_db\n  username: db_user\n  password: &lt;%= begin IO.read("/home/my_deploy_user/.db") rescue "" end %&gt;\n</code></pre>\n\n<p>Works a treat.</p>\n'}, {'answer_id': 3443973, 'author': 'slm', 'author_id': 33204, 'author_profile': 'https://Stackoverflow.com/users/33204', 'pm_score': 3, 'selected': False, 'text': '<p>Take a look at this github solution: <a href="https://github.com/NUBIC/bcdatabase" rel="noreferrer">https://github.com/NUBIC/bcdatabase</a>. bcdatabase provides an encrypted store where the passwords can be kept separated from the yaml files.</p>\n\n<blockquote>\n  <p>bcdatabase</p>\n  \n  <p>bcdatabase is a library and utility\n  which provides database configuration\n  parameter management for Ruby on Rails\n  applications. It provides a simple\n  mechanism for separating database\n  configuration attributes from\n  application source code so that\n  there\'s no temptation to check\n  passwords into the version control\n  system. And it centralizes the\n  parameters for a single server so that\n  they can be easily shared among\n  multiple applications and easily\n  updated by a single administrator.</p>\n</blockquote>\n'}, {'answer_id': 62938385, 'author': 'Rajkaran Mishra', 'author_id': 5946118, 'author_profile': 'https://Stackoverflow.com/users/5946118', 'pm_score': 2, 'selected': False, 'text': '<p>Better late than never, I am posting my answer as the question still remains relevant. For Rails 5.2+, it is possible to secure any sensitive information using an encrypted file credentials.yml.enc.</p>\n<p>Rails stores secrets in <code>config/credentials.yml.enc</code>, which is encrypted and hence cannot be edited directly. We can edit the credentials by running the following command:</p>\n<pre><code>$ EDITOR=nano rails credentials:edit\n\nsecret_key_base: 3b7cd727ee24e8444053437c36cc66c3\nproduction_dbpwd: my-secret-password\n</code></pre>\n<p>Now, these secrets can be accessed using <code>Rails.application.credentials</code>.</p>\n<p>So your database.yml will look like this:</p>\n<pre><code>production:\n  adapter: mysql\n  database: my_db\n  username: db_user\n  password: &lt;%= Rails.application.credentials.production_dbpwd %&gt;\n</code></pre>\n<p>You can read more about this <a href="https://guides.rubyonrails.org/security.html#custom-credentials" rel="nofollow noreferrer">here</a></p>\n'}]
['https://Stackoverflow.com/questions/18290', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1450/']