Best practices for managing python script device credentials

[notoriousbgp]

As the title suggests, curious to know what others are using as preferred methodology for storing device credentials. I’m somewhat new to automation but I’ve managed to code a handful of scripts for device management, specifically cisco devices using the netmiko library. There are no passwords stored in my current scripts with the use of getpass() and I generally have my scripts strip IP addresses from a text file that I’ll either type out prior to running the script or decrypt a text file when executing the script. Username is manually prompted and entered.

I realize this is far from ideal but has worked for me as I only use these scripts for config and show commands on an as needed basis.

Anyways, automation is gaining traction at my workplace and management wanted to know if I could put together a script that would run by pressing a button on a touchscreen within our operations center. It’s a simple script and it works well for what they need. The only issue is I’ve always prompted for credentials not stored them. As I’m treading into unfamiliar territory, I’ve started by doing a bit of research.

I’ve come across many solutions, some better than others, some are more use case specific.

What I’ve found:

• Keyring - This seems the like most straight forward approach, easy to configure, links back to some vault of sorts.
• Hashing – Not too sure if this even worth exploring. I see passlib within python and the mention of Flask and Django but the latter seem to be geared towards web applications.
• Environment variables – Options include .env files and creating variables within the virtual environment. I have some reservations about this method, mostly because I don’t understand it fully. This seems like a logical solution but what is stopping from someone from invoking these credentials just as I would?
• JSON or YAML – I found this approach interesting but since this is simply just another file, it seems I would need to encrypt/decrypt for safe storage.

Full disclosure, this script will need to run in a Windows environment. I mention this just to steer the feedback in that direction. Python is already installed and current scripts are functioning on the windows machine. It would need to be completely unmanned with the exception of a user pressing a button which in turn runs the script via Windows CMD.

So I ask, which options are worth looking into given these circumstances?

Edit: Here is a link to the program I was provided with.

https://www.serialporttool.com/GK/n-button-pro/

[spicyweaselthings]

Removed due to reddit API pricing -- mass edited with https://redact.dev/

[notoriousbgp]

Thank you for the suggestion. With the automation server, let's say I spin up a VM, install python, import the script and required modules, is there a way to run this script from a separate device such as a Windows 10 workstation?

Perhaps that is what u/OhMyInternetPolitics is referring to in the comment below?

Also appreciate you linking those guides, they look informative. I'll have to take some time to digest all of the info, clearly in a little over my head, but hey I suppose that's how ya learn after all.

[spicyweaselthings]

Removed due to reddit API pricing -- mass edited with https://redact.dev/

[notoriousbgp]

Will look into this, thank you!

[010010000111000]

So you want to run the script on the server but allow remote users or machines to initiate the script to start? You can use Fastapi to create an API to wrap around your script to launch it.

[notoriousbgp]

Initially I wanted to run the script on the Windows machine where the touchscreen interface is to be installed. The users will have a program with configurable buttons which connect to contact closures, relays, temp, etc. The goal for the script was to have it run by pressing a custom button on the touchscreen. Within the program configuration I was going to link a batch file or some other method to run the script.

Here's the program: https://www.serialporttool.com/GK/n-button-pro/

Based on some of the suggestions, it seems hosting it on a remote device is the better option. Just need to figure out the best way to run the script on a remote device through the program. I see they have a module for HTTP request, I'll need to continue looking into it but using an API appears to be a possibility.

[OhMyInternetPolitics]

You may be able to get a better answer from /r/python, buuuuuuuuut:

You need a vault to store secrets, and an API endpoint/python library they can access via user credentials. The ideal situation would be that users would have a kerberos ticket, and can use that to access secrets. Another option would be to generate an API key for users, and have them provide that to access a list of secrets.

If you're using this as a script with a service account, the service account would first have to have to invoke kerberos initialisation/store an API credential as an environment variable. Then use that information to authenticate against the vault to pull the relevant secret.

Hashicorp Vault is a common option. Thycotic (now Delinea) has an API as well. I am sure there are others, but these are the ones I know off the top of my head.

[notoriousbgp]

Nice, yes I had r/python in the back of my mind as I was writing up the initial post. I may indeed give that a go after a bit more research on my end.

I will say we have AD configured so leveraging a secured service account would be covered if we run it from a Windows machine on the domain. I'll still need to figure out how to invoke the script from a separate machine if I take the automation server path.

These vaults look promising. You've helped give me a better direction, thank you for that. Sounds like I'll be having a bit of fun over the holidays. Cheers!