php - Storing mail server pwd in database -


my laravel application needs connect 3rd party email server using mail server (smtp/imap) user & pwd settings (which different logged in user & pwd). each user have own user & pwd , when sending/receiving email, application have retrieve passwords db , communicate mail server.

in order achieve this, (unfortunately) need find way store mail server password on database, ability decrypt , send mail server plain string when authenticating.

one of reasons not being able use 3rd party email-as-a-service solutions (e.g. mailgun), apart cost, each user have different domain , settings, understanding requires custom solution.

obviously scenario exposes security vulnerability , therefore have following questions:

  1. is there method interact mail server using hashed password, or kind of token? (similar credit cards gateway can provide token based transaction , not have submit credit card info every time recurring transactions).
  2. what better alternatives storing password using built-in laravel encryption - uses openssl, aes-256-cbc , mac (while keeping ability decrypt later).
  3. to understanding, secured encryption still worth nothing once laravel private key breached (i.e attacker receives access server), or encryption key regardless of laravel's implementation. there better approach protect key being stored text file on server? (the default way laravel doing it)
  4. update make sense run separate server, passwords uses own encryption & key, , instead of receiving db directly application, retrieve 2nd server (so password encrypted twice, using 2 separate keys , attacker have gain access both servers in order decrypt). or perhphs use 3rd party dedicated services such aws kms, azure key vault or vault?


Comments

Popular posts from this blog

resizing Telegram inline keyboard -

command line - How can a Python program background itself? -

php - "cURL error 28: Resolving timed out" on Wordpress on Azure App Service on Linux -