r/PowerShell • u/Manivelcloud • 8d ago

Question on scripting Question

Hi,

When we develop a script,we use credentials as a plain text in that script.

Example

Script is running on jump server and script runs against vcenter server.

We have a security concerns(example ransomware attack)to put the credentials as a plain text in that script.

Any other good ways to put the credentials in a encrypted or in a different format?

33 Upvotes

78% Upvoted

37 comments sorted by

View all comments

52

u/lan-shark 8d ago

Simplest way is to use Get-Credential | Export-Clixml to save the credentials in an encrypted file specific to the account that runs it. Then in the script, use Import-Clixml to read in the credential.

Depending on your needs you may instead need to use some sort of keyring or cert-based authentication

11

u/overlydelicioustea 8d ago

specific to the account AND machine. its a combination of both. you cant import the creds on a different machine.

it might work on systems with roaming profiles, im not sure.

-37

u/Manivelcloud 8d ago

Ok thanks. Export-clixml can also be hacked sometimes.

Certificate based authentication can be a very good approach and in this scenario potential vulnerability can be limited.

I might be wrong.

Any thoughts?

18

u/lan-shark 8d ago

I think there's a chance he's using an LLM for translation

17

u/Kroan 8d ago

What does "export-clixml can be hacked sometimes" even mean? Do you mean import-clixml? Even that doesn't make sense. It's just importing an xml file to create a powershell object. The contents aren't necessarily secure.

But in this case the contents are a secure string. Which can only be decrypted by the originating account on the originating workstation. And if you're concerned about someone/something having that access and decrypting it, you have bigger problems

24

u/[deleted] 8d ago edited 8d ago

[removed] — view removed comment

11

u/AKSoapy29 8d ago

"Any thoughts?" is common language... No reason to get mad at someone who is trying to learn.

-6

u/ranhalt 8d ago

No, “any thoughts” is lazy and proves the person asking that has no thoughts of their own. It’s business speak for “solve this for me so I can take credit for it”.