How Do You Secure database.yml?

Question

Within Ruby on Rails applications database.yml is a plain text file that stores database credentials.

When I deploy my Rails applications I have an after deploy callback in my Capistrano recipe that creates a symbolic link within the application's /config directory to the database.yml file. The file itself is stored in a separate directory that's outside the standard Capistrano /releases directory structure. I chmod 400 the file so it's only readable by the user who created it.

• Is this sufficient to lock it down? If not, what else do you do?
• Is anyone encrypting their database.yml files?

Answer 1

The way I have tackled this is to put the database password in a file with read permissions only for the user I run my application as. Then, in database.yml I use ERB to read the file:

production:   adapter: mysql   database: my_db   username: db_user   password: <%= begin IO.read("/home/my_deploy_user/.db") rescue "" end %> 

Works a treat.