CiviCRM Community Forums (archive)

Primarily this is an FYI, in case people haven't come across this:

The CiviCRM SMTP server password is stored in clear text in the database.

When I started learning CiviCRM a couple of months ago, I experimented with different mail settings. I went back and forth between the SMTP and Sendmail options. (I'm using Sendmail now in my dev setup.)

I had to grep my MySQL db dump today, to remind myself which settings I used a while back. When I did that, I saw that the dump file had my SMTP password in there.

Unfortunately this password is used for a real, production SMTP server I control. Even worse, it's a password I use for other important purposes! Anyone who can read the dump file now has my password, which obviously I need to go change in the real world.

So:

1. Be careful which SMTP settings you use in CiviCRM, as your password can be exposed to anyone with access to the db or the db dump files (if unencrypted as they often are).

2. Consider this a feature request for password encryption in CiviCRM.

Harry

Added as issue CRM-4967

http://issues.civicrm.org/jira/browse/CRM-4967

Harry