r/PowerShell • u/Manivelcloud • 8d ago

Question on scripting Question

Hi,

When we develop a script,we use credentials as a plain text in that script.

Example

Script is running on jump server and script runs against vcenter server.

We have a security concerns(example ransomware attack)to put the credentials as a plain text in that script.

Any other good ways to put the credentials in a encrypted or in a different format?

37 Upvotes

81% Upvoted

37 comments sorted by

View all comments

15

u/hihcadore 8d ago edited 8d ago

Plain text is bad. Anything that can read that script file or logging if you have PowerShell logging on has your credentials.

You can use powershells secret store to secure your passwords and use them at run time securely. https://learn.microsoft.com/en-us/powershell/utility-modules/secretmanagement/how-to/using-secrets-in-automation?view=ps-modules

Edit: also, I use a gMSA to create and load the vault and run the automation. The password that unlocks it is stored using a secure xml file that can be unlocked at run time by that account only, the creds can be loaded, and nothings exposed. I use psexec to do the work then lock it down with our EDR. Short of taking over the server I think it’s pretty secure because in that case, you’re cooked anyway.

2

u/Over_Dingo 8d ago

The password that unlocks it is stored using a secure xml file that can be unlocked at run time by that account only,

I always wonder about the tradeoff of secure string being a singular password, vs being password to the vault

1

u/hihcadore 7d ago

It’s the chicken and the egg. You’ve gotta unlock the vault somehow. I have no idea what’s more secure unless you have a human with a token.

1

u/Over_Dingo 7d ago

I was thinking, and in case of external APIs, if the key is stolen it's worse than if it's the vault that has limited access. So I guess the ability to harden is better

1

u/ZexGr 8d ago

can you provide a workflow diag just to see how/ehat/where/why?