Java：将加密的数据库（和其他）密码存储在属性文件中的最佳选择是什么？

Question

I examine Jasypt for storing database encrypted passwords in property files. It has good integration with Spring etc., but approach of that this guys propose for encrypting password looks a bit weird as for me:

1. Use PBE (symmetric algorithm) encryption.

2. Store password for encryption/decryption in environment variable or in source code.

Both options look unsafe and a bit insecure.

My questions:

1. What is the best practice for storing encrypted passwords?
2. Can I use key based encryption (ie private/public keys) here?

Answer 1

In our application we use two approaches:

1. We use a enterprise password vault which stores the passwords for all our databases. Our web sever requests the password from the vault to connect the database every time.

2. We store Encrypted passwords in properties file. And during the application startup we read the properties file using class loader and keep it as a system variable and use it whenever needed.

It is difficult to have public/private key encryption directly with db, you would need an intermediary to do this.