From: Wilson Bilkovich Date: 2006-02-11T13:56:43+09:00 Subject: Re: why would i want to put my mysql password in the yml fil On 2/10/06, trevor wrote: > Pat Maddox wrote: > > Wouldn't you have to store the password SOMEWHERE? This comes up > > periodically on the list so do a search to find what discussion has > > already been had. > > > > Anyway, if you encrypt the password then somehow it would have to be > > decrypted, so you'd have to keep a readable key somewhere. Bottom > > line is that as long as you have correct file permissions you'll be > > fine. > > > > Pat > > ok, again i'm a bit confused by this. (sorry if it has been discussed, > i did a search and could not find an answer) > > so if that is the case, why does basically every other password > mechanism i can think of not just use plain text, and just rely on > having "correct file permissions". I'm curious then, where does mysql > store its username and passwords? are they available in plaintext > somewhere on my harddrive too? > > i'm not being sarcastic...i just don't quite get it... > Typically the server component (like MySQL) doesn't store your password at all. It merely stores enough information to verify that you've presented it with the correct password, but not enough to actually figure out what the password is, if someone stole the hard disk. A better analogy is that the database.yml file is like your keyboard. At some point, you have to punch the password in with your fingers, and if someone is watching your, they can record what you typed. MySQL is trying to verify the identity of the person connecting as "root". Since software is doing that on your behalf, the password has to be available to the software. The other alternative is to stand by the server and get ready to type whenever it wants to open a new database connection.