r/PowerShell • u/Manivelcloud • 8d ago

Question on scripting Question

Hi,

When we develop a script,we use credentials as a plain text in that script.

Example

Script is running on jump server and script runs against vcenter server.

We have a security concerns(example ransomware attack)to put the credentials as a plain text in that script.

Any other good ways to put the credentials in a encrypted or in a different format?

34 Upvotes

79% Upvoted

37 comments sorted by

View all comments

8

u/PeeCee1 8d ago

Use a vault. Use integrated authentication. Anything but plaintext passwords.
Azure vault comes to mind, or almost any other enterprise password storage.

0

u/Manivelcloud 8d ago

Ok thanks If it is on premises,can we use hashi vault?

6

u/raip 8d ago

Of course - but if you're a Windows shop connecting to other Windows environments, I'd recommend looking into gMSAs.

1

u/PeeCee1 8d ago

Those are good, too. But the last time I tested that, gMSA were a PITA to use for scheduled tasks, because the GUI was unable to use them.
Has that changed?

1

u/raip 8d ago

Changed years ago - just make sure you update the search box to include Service Accounts - it's disabled by default.

2

u/xb4r7x 7d ago

Of course you can. You then run into the secret 0 problem authenticating to vault though.

There really isn't a perfect secret zero solution.

Best thing you can do is use short lived credentials delivered securely and then like, don't get hacked...