Looking at the structure of most PHP/MySQL-based websites I've seen, it appears that it's not terribly difficult to discern the database password if you dig a bit, as there's invariably a setup or configuration file someplace that stores the information for logging into the DB. Other than the basic precaution of making sure that my database's privileges are appropriately restricted for remote requests, what options are available that I could implement in my own projects to protect this information?
Not a direct answer about storage of the passwords, but I generally use at least two database connections when building webapps -- one's used 99% of the time for user-related activities, with restricted privileges, and the other's used for 'admin' functionality (delete users, etc.).
In a few cases, where I'm installing someone else's package, I'll install two instances ... a public facing instance which only has database access to do the general user-type stuff, and a second instance that's IP-restricted to my local subnet (possibly even on a different machine) that has to be used for any 'admin' type activities. Neither one has access to modify tables, etc, though ... I'd rather go in via the native database tools than allow the webapp to run its own update tasks that haven't been vetted.
You can take it even further though, and add more connections specifically for given tasks ... so the user creation & password management tasks go through a user that has extra privileges on the user tables, login has database privs to authenticate and not much else, etc.
In this way, if there's a sql injection attack, on most webpages it can't really do anything significant -- can't see the password hashes, can't add a new admin user (not that they'd be able to do anything anyway), etc. It still won't help if they manage to get a shell on your machine, but it'll slow them down.
I'm a big fan of using PostgreSQL's 'Ident' authentication over local sockets whenever I can. That way, local users are mapped directly to the local computer's Unix/Windows users, and I don't have to worry about storing passwords at all. I don't think this is an option in MySQL yet, though.
Where the database and web server are on two separate machines, I use MD5 passwords over SSL: if a hostile has access to my frontend server, it's only a matter of time before he figures out how it communicates with the database.
If you're using the .NET Framework, you can look into using encrypted connection strings. I don't know if such a thing is possible in any other languages/frameworks, but that would be another safeguard to make sure that your connections are not compromised.
Outside of using encrypted connection strings, using LDAP/Kerberos/Active Directory is going to be your safest option.
If your passwords are stored in plain-text, use the hashes (MD5, SHA), Luke!
Depending on your programming language you could encrypt the login credentials, but if you're running an interpreted language then there's no way to ensure that someone can't figure out the credentials if they gain access to the system.
If you're running C++ or the like, then I would recommend you create/find a salted encrypt/decrypt function and run the credentials through that and store the resulting hash as a file on the system.
If you're running PHP or the like, I would recommend you write a wrapper for the
mcrypt_encrypt() and salt the credentials then run some code obfuscation to slow down any hackers if they do gain access to the system.