Hi, I am new to installing Discourse, and recently set it up on a Digital Ocean Droplet for us as our company forum/community page. During the install, I noticed the SMTP password entry is not protected, and it is stored as plain text in the app.yml file. That seems like a potential security issu…

If someone your don’t trust has access to your app.yml file your smtp password is the least of your worries.

How would you propose protecting it? Hashes are one-way, they can’t be reversed back to the original data. User passwords are hashed because they don’t need to be reversible. A password hash in the database is only consulted when the user tries to log in. The hash of the provided password is compa…

[صورة] pfaffman: If someone your don’t trust has access to your app.yml file your smtp password is the least of your worries. As Jay said, if someone gets access to your app.yml, you have other problems. That means they likely have full root access to your server including your production dat…

Hi All - Thanks for the replies. I agree that protecting the server is the first line of defense. However, in this case it’s out of my control since I have installed Discourse on a Digital Ocean Droplet. @Stephen - thanks for the background info on SMTP passwords. I did not know that it’s common…

[صورة] MidwestJay: However, in this case it’s out of my control since I have installed Discourse on a Digital Ocean Droplet. Not exactly :slight_smile: You can restrict logins to an SSH key only, have a running firewall, and make sure security patches are applied regularly. That’s a significa…

[صورة] MidwestJay: in this case it’s out of my control since I have installed Discourse on a Digital Ocean Droplet That’s right. And unless you have your file system encrypted, which is difficult to do, then you have to trust them too. They have physical access to the servers and the network. …

هل تم حفظ كلمة مرور SMTP كنص عادي؟

دعم المنتج تثبيت

justin (Justin DiRose) 13 مارس 2020، 4:36م 6

ليس تمامًا يمكنك تقييد تسجيل الدخول باستخدام مفتاح SSH فقط، وتشغيل جدار حماية، والتأكد من تطبيق تحديثات الأمان بانتظام. يُشكّل ذلك نسبة كبيرة من تأمين Droplet.

الموضوع		الردود	مرات العرض
Hiding or encrypting SMTP password required in app.yml Self-hosting	7	1455	26 أبريل 2017
Smtp password set during onboarding process Self-hosting	3	714	25 أبريل 2021
./discourse-setup puts SMTP username at start of SMTP password Product Support install	20	746	17 سبتمبر 2025
Should the password be plain text when creating a user through the API? Development	6	1328	19 يونيو 2020
[Résolu] Please les modalités simple pour modifier smtp_password Self-hosting email	9	342	18 نوفمبر 2025

هل تم حفظ كلمة مرور SMTP كنص عادي؟

الموضوعات ذات الصلة