I've got a Django project running on an Ubuntu server. There are other developers who have the ability to ssh into the box and look at files. I want to make it so that the mysql credentials and api keys in settings.py are maybe separated into a different file that's only viewable by the root user, but also usable by the django project to run.
My previous approach was to make the passwords file only accesible to root:root with chmod 600, but my settings.py throws an ImportError when it tries to import the password file's variables. I read about setuid, but that doesn't seem very secure at all. What's a good approach for what I'm trying to do? Thanks.
I'd place the password file in a directory with 600 permissions owned by the Django user.  The Django user would be able to do what it needed to and nobody else would even be able to look in the directory (except root and Django)
Another thing you could do would be to store it in a database and set it so that the root user and the Django user in the DB have unique passwords, that way only the person with those passwords could access it.  IE system root is no longer the same as DB root.
Linux/Python: How can I hide sensitive information in a Python file, so that developers on the environment won't be able to access it?