You don't need to keep the password in clear text. Encode it in Base64 and keep it in the configuration file. This will solve the problem of accidental viewing by some less tech savvy support personnel. But still it doesn't secure your password. If someone sees and remembers or notes down the encoded string, the original password can be retrieved from it easily. You can also encrypt the password with a key. Then hard code the key in the application itself. This will solve above problem as key can't be retrieved without doing a detailed analysis of your app. There are ways to embed the key text in an executable so that it won't turn up in the output of "strings" command.
Since MySQL requires password to be supplied in clear text, your application needs to keep it somewhere. Anyway none of the methods mentioned above guarantees hundred percent security.
The best practice is to keep sensitive data in a separate configuration file and don't keep it in the application base directory. For example if your application is installed in /user/local/myapp, the file with password should be kept in /etc/myapp.conf or something. So archiving the application base won't include this file.
Then above mentioned methods should be good enough.
Raghu
-
Raghu Prasad