# Plain text passwords in database.yml

**URL:** <https://www.ruby-forum.com/t/plain-text-passwords-in-database-yml/99346>\
**Category:** Rails\
**Created:** [July 21, 2006, 9:53pm UTC](https://www.ruby-forum.com/t/plain-text-passwords-in-database-yml/99346 "2006-07-21T21:53:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fozbaca](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/f0a364/32.png) [@fozbaca](https://www.ruby-forum.com/u/fozbaca)\
**Post date:** [July 21, 2006, 9:53pm UTC](https://www.ruby-forum.com/t/plain-text-passwords-in-database-yml/99346/1 "2006-07-21T21:53:53Z")

</div>

Hi All,

It is our corporate security policy to not leave plain text passwords  
in text files (such as database.yml).

I would like to to roll out a Rails application, but would like to  
find another way to connect to MySQL without leaving plain text  
passwords in database.yml

Any thoughts?

Thanks,

Brian L.

---

<div class="post-metadata">

**Author:** ![fozbaca](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/f0a364/32.png) [@fozbaca](https://www.ruby-forum.com/u/fozbaca)\
**Post date:** [July 21, 2006, 10:03pm UTC](https://www.ruby-forum.com/t/plain-text-passwords-in-database-yml/99346/2 "2006-07-21T22:03:45Z")

</div>

The only way to accomplish that is to make rails read the password  
from the command line when you start the server. Not sure how  
difficult that would be, although I would be curious myself.

Chris

---

<div class="post-metadata">

**Author:** ![fozbaca](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/f0a364/32.png) [@fozbaca](https://www.ruby-forum.com/u/fozbaca)\
**Post date:** [July 21, 2006, 10:10pm UTC](https://www.ruby-forum.com/t/plain-text-passwords-in-database-yml/99346/3 "2006-07-21T22:10:20Z")

</div>

database.yml should allow erb style commands like the views do.  
So a something like this should work

\<% require ‘SomePassStuff’ %\>  
development:  
adapter: mysql  
database: jongretar\_development  
username: \<%= “root” %\>  
password: \<%= decipher\_pass() %\>  
host: localhost

Not sure what is the most secure way do encode and decode the password  
would be. Just wanted to point out about the erb’ness of yml.

On 7/21/06, Brian L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Thanks,
> 
> Brian L.
> 
> * * *
> 
> Rails mailing list  
> removed\_email\_address@domain.invalid  
> [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails)

–

---

<div class="post-metadata">

**Author:** ![fozbaca](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/f0a364/32.png) [@fozbaca](https://www.ruby-forum.com/u/fozbaca)\
**Post date:** [July 22, 2006, 8:39am UTC](https://www.ruby-forum.com/t/plain-text-passwords-in-database-yml/99346/4 "2006-07-22T08:39:32Z")

</div>

On Jul 22, 2006, at 7:50 AM, Brian L. wrote:

> It is our corporate security policy to not leave plain text passwords  
> in text files (such as database.yml).

The policy must have exceptions for automated operations, or else every  
server reboot would require a human to be present, to provide  
application passwords … or at least the decryption passwords for your  
encrypted config files 🙂

> I would like to to roll out a Rails application, but would like to  
> find another way to connect to MySQL without leaving plain text  
> passwords in database.yml

Easy - does your security password disallow accounts that have no  
passwords? Then set one up, and leave the password field in  
database.yml blank – no more security “problem”.

-jim