Re^5: encrypt passwords

[CountZero]

store them in a local file that only the process that needs them has read permissions for

That is not a bad idea but it may get messy if you have to update the file: either you give more users access to the file or you must switch to become the user that has sole access or --horror-- you become root to access the file, a sure way to mess things up badly.

Most databases allow fine-grained access levels to the data: reading, writing, deleting, updating, ... all or some can be given or not to specific users.

For man years I run a claims database that once was acccessible through a web-page. The webserver only had a read access to the main data-tables, but could add/update/delete records in tables that stored comments. I never had any corruption of the main data tables, but regularly had to "clean" the tables holding the comments.

As the OP already has a database-server running, it will be no big effort to add a small table with the password data.