How do I avoid having the database password stored in plaintext in sourcecode?

Question

In the web-application I\'m developing I currently use a naive solution when connecting to the database:

Connection c = DriverManager.getConnection(\"url\",          


        

Answer 1

1. Create an O/S user
2. Put the password in an O/S environment variable for that user
3. Run the program as that user

Advantages:

1. Only root or that user can view that user's O/S environment variables
2. Survives reboot
3. You never accidentally check password in to source control
4. You don't need to worry about screwing up file permissions
5. You don't need to worry about where you store an encryption key
6. Works x-platform