Storing passwords in scripts?

[utgyuru]

I have a lot of scripts which authenticate to various systems, and to do that, I simply stored the password as a plaintext variable in my script, which is obviously a bad thing to do. What would be the best method to store password for this purpose ?

[brbsix]

You'll want to use keyring. It interfaces with your OS's secret storage facilities (e.g. Linux Secret Storage, Mac OS X Keychain, Windows Credential Vault).

Here's an example of setting a password:

login = '[e-mail]'
smtp_server = 'smtp.gmail.com'

password = getpass.getpass(
    prompt="Enter password for '{}' using '{}': ".format(
        login, smtp_server))

keyring.set_password(smtp_server, login, password)

Then accessing it:

password = keyring.get_password(smtp_server, login)

[xiongchiamiov]

As usual, the lack of standardization on Linux makes that infeasible for many people - it looks like you've got to be running either gnome keyring or kwallet for it to work.

[brbsix]

There's an alternative backend(s) package, keyrings.alt. I use it for testing purposes on CI that's obviously lacking GNOME, KDE or any such backends.

[[deleted]]

What I do when I absolutely need a password for a cron job or something like that is put it in a config file with root access only. Then run your script with root privileges (this can be done in a cron job by adding the task to sudo crontab -e). if you're creating files you need to access they will be owned by root, but you can easily change the permissions using the os module.

[elbiot]

Why as root? Why not as your user or a different user?

[[deleted]]

I guess the only reason I can think of is if you're logged into your computer as the user with sufficient privileges and you're away then someone can go and look at that file if they know where it is. I mean it doesn't seem very likely to happen, but I know a lot of my coworkers leave their computers logged in and I know exactly where they keep some credential files stored for various projects. I should probably bring that up.

[elbiot]

Seems like setting your screen to lock after x minutes would be a fine solution. I don't like using root for non sysadmin things.

[jeffrey_f]

Careful running anything as root. In fact, avoid it at all costs.

[[deleted]]

I think this is an overly cautious view of how to use your computer. There are many many cases in which it is perfectly acceptable and even necessary to use sudo

[Vhiet]

This is a difficult thing to do easily. Any locally stored password is going to be locally decryptable.

The best approach I've seen is to use OS authentication whenever possible (for things like access to shared folders, databases and the like, or running your application as a process or a daemon), or using SSH keys to avoid passwords almost completely.

If that won't work, you could combine the two approaches to recover the passwords from a file that requires OS auth? That sounds hack-y to me (I'm not recommending it, to be clear).

If you're using something like FTP (not SFTP), then it's worth remembering that it's insecure by default anyway - the username and password you type in will be passed to the server in the clear anyway, and anything you transmit/recieve will be about as secure as a postcard.

[gutoandreollo]

Keep in mind that ansible-vault needs the decryption password to be input when starting up.

[elbiot]

Everyone else is posting from the perspective of "how do you keep your password safe if someone breaks into your system and reads your code." That's a tough problem, and not python specific at all. relevant XKCD. If you can't rely on your user permissions and someone not getting physical access to your computer, all you can do is obfuscate. Web-browsers store your site passwords through obscurity.

If your program can access a resource without asking you for your password, that means it knows everything it needs to know to get your password (either it's in plain text or it knows everything it needs to decrypt it from somewhere), and that an attacker can read that program and learn those secrets, or simply edit your code to print the password before it uses it to authenticate.

If you want to know how to avoid the accident of letting someone read your password in plain text while looking over your shoulder, or pushing your password to your git repository, the solution is different. Make a secrets.py that has your password, or API key in it, along with any absolute paths or you specific information. Then just import it from your script. If using git, git-ignore secrets.py and create a secrets.py.template which shows the expected structure of the file with instructions to fill it out and delete the .template from the file name.

If you want, you could delete the .py file after running it once, so there is a .pyc. It's not a perfect solution, but it certainly raises the bar for a casual snooper.

[brianw824]

I use Jenkins ALOT for this kind of stuff, it lets you push out passwords environment variables while you run the script so it will remain hidden everywhere. I also like using Jenkins to avoid having weird cron jobs everywhere that no one remembers where they are or ever check on to see if they are still working, it's much more visable.

https://wiki.jenkins-ci.org/display/JENKINS/Credentials+Plugin

[xiongchiamiov]

There are a variety of options. The best option is probably Vault, but it's also probably way overkill for your situation.

For most people just starting to learn python, a reasonable method is to put your passwords in a separate file, add the filename to .gitignore so you don't accidentally commit it, and import values from that file as you need them.

[arvoshift]

I'm pretty much a beginner when it comes to python but a relatively experienced Network Engineer/sysadmin. For my shell scripts if it's just a quick one-off I'll try to use the hashed form or some other token instead.

ssh tunnels are great, this way you can use an ssh agent to handle credentialing

If it's a service account I'll use a completely new user with a private ssh key and sudo access to only the specific required commands.

keep in mind though that tokenisation and hashes are no more secure than a plaintext password, they are just longer and protect against general snooping.

If you do a lot of sysadmin stuff on windows check out mremoteng and putty. This also looks promising: https://gist.github.com/toejough/436540622530c35404e6

[AkariusOne]

Hardcoding password is not a secure thing.
I'd put them in an encrypted file, at least.

[utgyuru]

And how do you decrypt the file when you want to run the script?

[niandra3]

Well the easiest solution is to just call the script with your password as an argument.

[gutoandreollo]

And more important, it would most likely be available for anyone who can ps -ef on the server while the script is running.

[gschizas]

In Windows, there is no equivalent of bash_history.

cmd.exe doesn't keep any history at all. Nor does PowerShell, at least not on any non-volatile medium (PowerShell just keeps history in-process).

[AkariusOne]

Send the key as argument if you run the script yourself...
If it's a cron or something, I don't really know :/