1

Basically, I want to cache the credentials needed for New-PSSession and make them available to scripts so they don't have to nag a human.

If I use export-clixml or similar to store a PSCredential on disk, how much of a risk of compromise does that add over keeping it in a session variable?

7
  • How risky is it to store your money on your desk? Turns out I'd been "storing" 3 grand on my desk for the last month or so. but no one took it, so that must mean my desk is a safe place to store money, right? Mar 18, 2015 at 16:44
  • @hopelessnoob doesn't make it safe, but it might bbe safe enough if it's in a building with multiple swipe access to get to your desk.
    – Simon Gill
    Mar 18, 2015 at 16:54
  • No, this was at home. Granted, my home is a little more secure than the average home, but that just means there are only a handful of ways to get in with a swift kick or a screwdriver, instead of the usual dozen+. Mar 18, 2015 at 17:20
  • @HopelessN00b I don't think your analogy works. A PSCredential is encrypted is such a way that it 'should' only be usable by a single user on that specific computer. It isn't like that cash, which you can just pick up an walk away with. IE you can't just boot to offline media, grab the credential file and be able to use/decrypt it.
    – Zoredache
    Mar 18, 2015 at 17:59
  • Here are some links about how it works. Not sure if you can call it secure or not. technet.microsoft.com/en-us/magazine/ff714574.aspx - msdn.microsoft.com/en-us/library/ms995355.aspx - thomas-franke.net/powershell-manage-passwords-credentials - Of course this all probably boils your question down to the new question. How secure is the Windows Data Protection API?
    – Zoredache
    Mar 18, 2015 at 18:03

2 Answers 2

1

PSCredential encrypts the string using that machines private key. The encrypted data has the same level of protection at rest as it does in motion. The level of encryption is dependent upon the certificate being used, so check your environment's certificate template for machine auto enrollment (if you use it). Alternatively you could just look at the certificate on the machine in question.

Having said that, the string can easily be decrypted with a powershell one liner (using .Net not the built in cmdlets). All someone needs is access to the system and the file. I strongly recommend you look at other alternatives, like a locally hosted password management tool.

0

How locked down is your server from an access perspective? Who has access to the server and what can be done if someone does get that password? Most folks could read your script, figure out what the password is used for and ultimately utilize it for malicious purposes. Even if its encrypted.

If it was me, I'd look at a few different options:

  1. If you haven't done so already, run the script as a scheduled task that has the credentials you need. If this is not doable because its a different type of credential. Option 2/3 would be more preferred.

    1. Look into something like "secrete server" http://thycotic.com/products/secret-server/ This type of solution has APIs so you can access the credentials from API's.

    2. There are tools like "JAMS" http://www.jamsscheduler.com/ that can also store credentials and run tasks / scripts as specific accounts. you can do things like build work flows too.

5
  • Real reason I'm considering this is that I couldn't find any way to use the current powershell hosts credentials to pass to a cmdlet.
    – Simon Gill
    Mar 18, 2015 at 16:57
  • can you provide a more clear example of what its you're trying to do? So if you're running a script as yourself, you're saying that whatever cmdlet your using prompts for credentials and doesn't simply "runas"? Mar 18, 2015 at 17:37
  • BTW, if what i'm stating is what you're looking for, point 2 in my answer is an example of a safe way to handle this. Mar 18, 2015 at 17:42
  • I'm running a script as me, but I want to be able to import lync commands from a remote session within my scripts. It's also a potential issue with storing passwords to use DSC when building new domains.
    – Simon Gill
    Mar 18, 2015 at 17:49
  • If you run the script as an account that has the privileges, there should be no need for specifying credentials. As for joining a domain, again I would suggest point 2. Or use an account that only has privilege to create computer accounts Mar 18, 2015 at 19:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .