Encrypted passwords for better security on server

Question

I use wordpress and other CMS's and all these have plain text passwords in their config files e.g. in wp-config.php

I wonder is this the normal way an administrator would protect security?

I realise its possible to move the wp-config outside of the root web directory, but still if the server itself is compromised, its possible to find the wp-config file and the password inside, then the system is comprimised.

Is there a way to encrypt all passwords on the system, so that in the web applications config files it uses the encrypted pass and not just plain text? Is there a sensible way of keeping plain-text passwords off the server?

PS i use linux vps ubuntu servers

Cheers Ke

Answer 1

I've never seen or heard of the password in wp-config.php being encrypted .

I think you should take a look this Securing wp-config.php guide. Instead of encrypting the password from WP-Config, you can protect the profile in other ways however it’s almost impossible to view php files from remote, you should have access to ftp to do that.

Answer 2

Is there a way to encrypt all passwords on the system, so that in the web applications config files it uses the encrypted pass and not just plain text?

Maybe. But what's the point of that? The web application needs a way to decrypt it - and if it can do that, there's nothing to stop $RANDOM_CRACKER from doing the same.

...as Phoshi said in a comment, if $RANDOM_CRACKER gains access to your config file, you have bigger problems anyway.