PowerShell Password Encryption

Question

I have a powershell script that connects to a MySQL database. Of course, a connection is needed for this connection, and I would like to somehow encrypt the password, and not store the password in plain text.

I looked at the securestring methods, outputting the password to a file, but I do not think that they will work, because the encrypted password can only be decrypted by the original user, and the script will be distributed to several machines throughout the network.

Any suggestions on any other methods that would be helpful?

thanks

Answer 1

If the script will be distributed to several machines over the network, then all the credentials that your script will use will be available to these users, and there is no way to get around this.

You can do two things if there is personal data for each user:

• create a new user account in the database for each user of your program with restrictive permissions, allowing them to do only what you want, and nothing more
• have a proxy server that will authenticate them and connect to the database in their name (this is how most websites work).

If all the data is public and read-only, you can:

• create a user account in the database for read-only access and use its credentials in all distributed copies of your program.
• It has a proxy server that does not authenticate users, but connects to the database, and does not disclose it to the public.

Number 2 of each of these parameters is usually recommended for each database with MySQL security history, but number 1 of both of these parameters will be recommended for databases such as CouchDB.

Never distribute any credentials with your program that you do not want your users to use.

Answer 2

I used this PowerShell library http://lunaticexperiments.wordpress.com/2009/10/23/powershell-string-encryption-and-gpg/ to encrypt Oracle and Informix passwords.

Here is an example

#Source Encryption Functions . ./Library-StringCrypto.ps1 #encrypt string using passphrase $encrypt = Write-EncryptedString $connString "4#&7yaoff" #Show encrypted string $encrypt #Decrypt string Read-EncryptedString $encrypt "4#&7yaoff"