Beefy Boxes and Bandwidth Generously Provided by pair Networks Bob
Think about Loose Coupling
 
PerlMonks  

Where should I have configuration information in a file or database

by vinoth.ree (Vicar)
on May 29, 2009 at 11:32 UTC ( #766845=perlquestion: print w/ replies, xml ) Need Help??
vinoth.ree has asked for the wisdom of the Perl Monks concerning the following question:

Where should I have configuration information in a file or database, on the basis of security and accessibility ?

Hare Krishna

Comment on Where should I have configuration information in a file or database
Re: Where should I have configuration information in a file or database
by jethro (Monsignor) on May 29, 2009 at 11:57 UTC
    Depends on your application. If the rest of the application needs a database anyway, you might store the configuration in there too. But if part of that configuration is the name and password of the database, obviously the database isn't a good place to store it ;-)

    In most cases a file is easier to handle, faster to access and easier to edit by hand

Re: Where should I have configuration information in a file or database
by akho (Hermit) on May 29, 2009 at 11:58 UTC
    It depends on your problem. And your skills.

    You should tell us more about your problem if you want us to help.

Re: Where should I have configuration information in a file or database
by irah (Pilgrim) on May 29, 2009 at 12:53 UTC

    In most of the case, the file is simplest way to store the configuration information. We can easily handle like changing configuration information. We don't want to enter into database regularly.

    on the basis of security

    If you are storing the information in database, you have to give database user name and password in the function to connect database. It may not secure if your are giving program to some other person. But if you are storing in file, it's not needed. But at the same time, the file don't have permissions for other users.

Re: Where should I have configuration information in a file or database
by bichonfrise74 (Vicar) on May 29, 2009 at 15:47 UTC
    In any case, there is not much of a difference. You can easily read / edit the information in a file or a database. I recently used a file to store my configuration information which contained several hashes of hashes and I consciously did this so that I can practice manipulating HoH.

    But again, there is really no difference. I could have very well stored the configuration information in a database and simply wrote some SQL to retrieve the configuration information.
Re: Where should I have configuration information in a file or database
by Old_Gray_Bear (Bishop) on May 29, 2009 at 16:18 UTC
    For ease of usage, I keep the configuration for my critical databases in a file rather than a database table. For security, the file is on a USB thumb-drive that lives, when it is not plugged into the computer I am working with, in my brief-case. The brief case is either on my person, sitting in a locked drawer in my desk, sitting in a locked side-bag on my motorcycle, or (once I get home) being slept on by a 25 pound watch-cat. The cat likes the way the canvas book-bag adapts for his express comfort when he rolls over.

    I back the drive up one a week; the back up is encrypted and and two copies are stashed, one on my work lap-top and the other on and old server machine at home. I keep the four previous generations of the backup, just in case. (In addition to the DB connection parameters for three moderately and one critically important Work databases, my Work Diary and some digital photographs that can't be replaced, children do grow up after all, are stored on the drive.)

    In the past five years I have had to invoke the recovery procedure just once, but I do a recovery test once a quarter to make sure that I can. I am probably being a little be over-board on the paranoia side here, but....

    ----
    I Go Back to Sleep, Now.

    OGB

Re: Where should I have configuration information in a file or database
by Your Mother (Canon) on May 29, 2009 at 16:19 UTC

    I prefer files for application/admin configuration and DB for any user controlled configuration (most of the time). Files are safer for an application because you aren't relying on (at least) two services (your app and the DB) to run your app. Configuring from files allows the application to run "normally" (in reduced service mode or something) even when the DB is unavailable. Of course files can become unwieldy so the DB is (like mentioned already) better for many other things (that will grow, require constant update, fit into a standard API, etc).

Re: Where should I have configuration information in a file or database
by nikosv (Hermit) on May 29, 2009 at 17:19 UTC
    Obviously in case of a storing the connection string it has to be stored in a file. This has the further advantage that you can easily change it.A hybrid approach is that of having separate sections in the config file to store sensitive content that must be encrypted ie the connection string and must be decrypted by the application. Such an example is what .Net 2.0 does: it wraps this kind of sensitive data into <protectedData> tags inside the configuration file
      sections in the config file to store sensitive content that must be encrypted ie the connection string and must be decrypted by the application.

      This may give you a warm fuzzy feeling that you have used encryption and so everything simply just must be safe.

      But this is just a little annoyance for anyone trying to get the data: The application must contain the decryption code, and it must contain the decryption key. Both can be extracted, and with the addition of a few simple print statements, you can see the "protected" information in plain text. If the decryption code is burried in the runtime environment, things become even easier for an attacker: Just find the key, call the runtime environment's decryption routine in your own ten line script, and print what it returns when processing the "protected" information.

      Oh, and I almost forgot: How does it help to encrypt information in a config file that are afterwards transmitted in clear through the network, e.g. when connecting to a MySQL or FTP server?

      Alexander

      --
      Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)
        Ok,I have to elaborate more :
        You create a key container. There are machine-level and user-level containers
        Specify a protected configuration provider (RsaProtectedConfigurationProvider or DataProtectionConfigurationProvider) which essentially is a class that you can use from your code.

        Pass the provider your key container (in case of RSA,in case of DPAPI is simpler) and when saving the configuration file the <protectedData> sections will be encrypted.
        The decryption key is not included in the configuaration file or the application.
        e.g. in the case of DataProtectionConfigurationProvider the decryption key is auto-generated and saved in the Windows Local Security Authority.

        When calling the application the .net framework will decrypt the connection string and makes it available to your application. You don't have to write any code to encrypt or decrypt.
        Of cource if the memory of the application is compromised, the sensitive information might get compromised as well.

        "How does it help to encrypt information in a config file that are afterwards transmitted in clear through the network, e.g. when connecting to a MySQL or FTP server?"
        well the original question was "Where should I have configuration information in a file or database, on the basis of security and accessibility",
        did not ask anything about securely transmitting the connection string, but in case you are curious you might want to look at Secure connection to SQL Server from Perl DBI

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: perlquestion [id://766845]
Approved by Corion
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others examining the Monastery: (5)
As of 2014-04-19 21:41 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    April first is:







    Results (483 votes), past polls