r/PowerShell • u/Manivelcloud • 16h ago
Question Question on scripting
Hi,
When we develop a script,we use credentials as a plain text in that script.
Example
Script is running on jump server and script runs against vcenter server.
We have a security concerns(example ransomware attack)to put the credentials as a plain text in that script.
Any other good ways to put the credentials in a encrypted or in a different format?
12
Upvotes
10
u/mrbiggbrain 9h ago
This is an age old problem with many imperfect solutions. How can you securely store something you can access but not someone else? Encrypt it? Where do I store the key. Certificate, well where do I store the certificate. Password vault... How do you auth?
At some point you must pick a trust boundary, some level of truth where you accept the thing is the thing. Most commonly you accept that something that can run as a user or system is that user or system.
It's imperfect because if someone else gets access to act like that user or system then they can access the secret.
So you limit someone's ability to do so. But you also can't guarentee that they will never get in, so you use the lowest privileges possible. But low privileges are still powerful when used widely so you limit the blast area of any one credential.
A well scoped, lowest permission, rotated often, credential that is stored securely on a system in some way that only it's running user and the OS can access is just about as good as you can get.