I have PowerShell scripts that need credentials, including one that connects from a Windows jump server to vCenter. What's a safer option than putting passwords in the script or a separate JSON file?
What's a secure way to store credentials for PowerShell scripts?
Asked by
7fold_paper_problem
Answers
For an unattended script, a vault or secrets server is a good place to start. Give the script's identity access only to the secrets it needs, then retrieve them at runtime. You can use an on premises vault or a cloud service, depending on your setup.
Plan how the script authenticates to the vault too. If you just leave a plaintext vault password next to the script, you've moved the problem rather than solved it. Certificates or a managed identity may be options, depending on where the script runs and what the vault supports.
Reply to this answer
Before storing a password, check whether the target supports integrated authentication for your use case. A scheduled task running under a group managed service account can avoid a manually stored password when the required services and authentication methods support it.
That won't automatically solve authentication to every application. If vCenter or another target needs a separate credential, you may still need a vault or another supported authentication method.
Reply to this answer
For a simple Windows setup, Get-Credential piped to Export-Clixml can save a credential for later use with Import-Clixml. The encrypted credential is normally tied to the Windows user and machine, so create and read the file under the account that will actually run the script.
It's a practical local option, not a defense against someone who can run code as that account. Protect the file with appropriate permissions and test the setup under the scheduled task's identity. Don't assume the same protection applies on non-Windows systems.
Reply to this answer
For interactive scripts, a prompt or Windows Credential Manager may be enough. PowerShell SecretManagement can provide an interface to a vault too, but check how the chosen vault is unlocked. A prompt is fine when someone is present and a problem for an unattended job.
Reply to this answer
Moving a password from the script into a JSON file doesn't encrypt it. Anyone who can read that file can read the password, and plaintext in scripts can also end up exposed through logging. Keep secrets out of both places.
Reply to this answer
Add your answer
Answers are reviewed before publication.
7fold_paper_problem:
Would that protect the credentials if the jump server itself is compromised?
~crayon+on!standby:
Not necessarily. An attacker who can act as the script's identity may be able to retrieve its secrets, so restrict that identity's permissions and access to the server.