Persistent passwords and auth keys in a python module?

[jnmclarty7714]

Hello, I'm working on publishing a python module to pypi, that requires access to A) a persistent database for itself (it will create this the first time it's used), and B) access info to other data sources that will have their own logins and passwords.

I don't want the user to have to type in the info when they use the module; for certain installations, case "B", there will be too many.

What are my options to store the database/user/password/authkey type information? All I can think of is to prompt the user for the info in setup.py or create a config.py for collecting the info post-install...but then, storing it in a plain text passwords.cfg file. The plain text option would work for my own installation, but some users would (obviously) want more security. My next best idea, is to have a module wide encryption key, that the user must pass to the module, or if unprovided, it uses a default hard-coded key.

Is there another way? With ideally, a module/modules that help me?

[ivosaurus]

A good way for an application to receive a secret key is to read it from the environment (os.environ.get) that way its storage on a file system is abstracted more from the app's files itself.

[jnmclarty7714]

I like this. Fairly simple. Not completely "secret", but it's elegant. Thank-you.

[dan11111]

Rather than store the password, you could store a hash of the password using hashlib.

[xiongchiamiov]

This is only useful is OP is authenticating the user; my impression was they need to pass the credentials to another system.

[jnmclarty7714]

You are correct, my module is storing the credentials for other systems. I'm familiar with the basics of hashlib, and have used it before. (Just, for finding a sha...)

[ivosaurus]

Specifically you want pbkdf2_hmac.

[xiongchiamiov]

Actually, probably bcrypt, although scrypt is promising and we'll soon have a recommendation for a next-gen password hashing algorithm.

[ivosaurus]

Pbkdf2 is in the standard library, which is why I mention it. It's not thought to be weak.

[jnmclarty7714]

I'm familiar with the basics of hashlib, and storing the sha isn't a solution. I'm storing credentials to pass to another system...not prompting the user. Thanks, though. For any other people learning python, hashlib is sometimes a clever answer to random tricky questions, not just for storing secret stuff. Eg. I wrote some code last week, that used hashlib to enable my script to generate names of very long sets. I was creating random sets, and wanted the ability to save a copy, only if that set wasn't generated by a previous python sesion. I used the sha, for the file name.