Home/ Questions/Q 8315271
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-08T21:05:41+00:00

I use openssl and mysql encryption trough PHP. Currently, I write the key in

  • 0

I use openssl and mysql encryption trough PHP.
Currently, I write the key in the php source code, but I think it isn’t so secure. If someone gets the source (maybe FTP), encryption is broken.
So, how would you store encryption keys on Linux server? I can’t use another webserver to store the key.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I’m assuming you are using Apache.

    Put the secret data into an environment variable in /etc/apache2/envvars, set the owner to root and the permissions to 400.

    An attacker will have to compromise the server to put his hands on your key.

    You can also cook up a script that asks for the secret when Apache starts (annoying, but even more secure).

    Note that people with root access will always be able to get your key and trying to hide it from them is just a placebo.

    Placebo solution:

    • Make your application idle by default until you POST your key to an HTTPS page within the same application, save your key in a global variable and proceed with your business. You have to consider the PHP process’ lifecycle (when the process terminates, you have to resend your key).
    • 0