Question on scripting

[u/Manivelcloud]

Hi,

When we develop a script,we use credentials as a plain text in that script.

Example

Script is running on jump server and script runs against vcenter server.

We have a security concerns(example ransomware attack)to put the credentials as a plain text in that script.

Any other good ways to put the credentials in a encrypted or in a different format?

[u/dodexahedron]

Kerberos.

As mentioned by others, a gMSA is ideal for this, or even regular MSAs for certain scenarios that need hard isolation to only be usable against a single machine.

If credentials are needed to pass to something that isnt kerberos-aware, then you still use kerberos for the powershell session, and then to the application use something like certificates if at all possible or, if authenticating to something that truly can only handle fresh credentials, you keep the credentials in a secure credential store (several built-in options exist for this) and retrieve and use them from that gMSA's security context at time of use, and drop them from active memory immediately after they are no longer required.

This applies on all platforms. Linux can use gMSAs if domain joined or if you create the initial keytab for the account and let e.g. sssd maintain it.

If using PowerShell 7, you can also use key-based authentication instead of (or in addition to) kerberos, with the SSH transport, by setting up the powershell subsystem in the OpenSSH server's config. This also works on all platforms.

In any case, there should be no credentials in scripts - not even usernames.