How to avoid plain password in mod_ldap

Question

There are a plain password store in mod_ldap. Is there any way to encrypt the password?

AuthLDAPBindPassword password

Thank You.

Answer 1

No, because even if it's encrypted, something eventually has to decrypt it in order to actually use it to bind to the ldap server. If somebody is able to read that file, then it's pretty likely they'll be able to decrypt it using the same mechanism that apache would eventually have to use.

You should set the permissions on the file so that it's only readable by the apache user.