How to securely store database password in Python?

Question

In PHP the accepted way to secure database login credentials is to store them outside the web root, and to include() the files with the passwords. How are MySQL database login credentials safely stored in Python applications?

Solution

Well, one way of doing this is putting the passwords in a separate config/ini file that is not deployed with the project. And then, pass the path of this file to the main entry of the application, e.g.:

python main.py --config=/path/to/config.ini

Note that you'll need to parse this --config argument (see argparse) and then read and parse the config.ini file.

Update: Since you mentioned web applications, there is also another way of passing configuration information - through the environ. For example, if you use mod_wsgi, you can putt this in the wsgi directives:

SetEnv my_namespace.some_param some_value

And then, this value will be accessible in the application with through os.environ:

import os
os.environ['my_namespace.some_param']

Comments

[hakre]

What have you found out so far? Looking into PHP applications seems useless if you want to learn about practices in Python in my eyes. And luckily there is a lot of Python code floating around, so what has your research covered up?

[dotancohen]

I mentioned the PHP best practice as it is an environment that I am familiar with. As for Python, I've found only suggestions to obfuscate the password (base64 or the like), and to ensure that the Python file is not readable by others (0700 permissions). I ask here if there is a better way.

[northben]

I use the keyring library (pypi.python.org/pypi/keyring) and store the actual credentials in the OS's credential storage utility. It's very easy to implement, and it seems quite secure to me.

[dotancohen]

@northben: Thanks, that does look like a good possibility.

[amanb]

Another possibility is to use configparser to parse contents of a config.ini file.