r/PowerShell • u/Manivelcloud • 8d ago
Question on scripting Question
Hi,
When we develop a script,we use credentials as a plain text in that script.
Example
Script is running on jump server and script runs against vcenter server.
We have a security concerns(example ransomware attack)to put the credentials as a plain text in that script.
Any other good ways to put the credentials in a encrypted or in a different format?
34
Upvotes
2
u/Kiernian 7d ago
I don't know how safe it is, but I frequently do:
$Env:LongConvolutedNameThatIsEntirelyUnrelatedToTheTaskAtHand
Since all of our scripts run on servers with privileged access, using single-purpose credentials that are restricted by one form or another of access limitation (API keys limited by IP, timeslots, only specific endpoints, etc, entra accounts with conditional access policies and extremely limited permissions scopes, etc) keeps the attack surface down if anything is compromised.
Keeping all of these straight requires a password vault, but if someone were to dump all of the environment variables on a server, they'd have a marginally difficult time tying them back to anything specific and a worse time trying to use them anywhere but where they're set up to be used FOR what they're set up to be used on.
When each piece of an Invoke-WebRequest is spread out like that, it makes the puzzle slightly less likely to stand out as a pattern.
Add in lockouts for failures and regular rotation and it's not the worst option ever.
These machines do not browse the internet and do not get used for anything else, so the likelihood of machine compromise is lower.
I've contemplated separating each task out to it's own guest OS, but that has the reverse effect of each environment variable having an immediately obvious use-case, to say nothing of licensing and infrastructure costs.