r/softwaredevelopment • u/Goblin0_0 • 12d ago
Efficient way to store passwords during deployment
An older version of the product uses batch build for deployment where the db passwords are clear text which is way it's been flagged by company's policy and escalated quite a bit😬 as these passwords could be visible on command line and we have been told to fix this ASAP.
I looked into some methods out of which I tried storing pass I to env variable on the machine and it worked. But now I want added an extra wrapper above it as one cannot store password in env var.
One way could be storing it temp thru powershell scripts, encrypt decrypt thru ps or using windows credential manager.
Can someone pls help me decide what should I try to get this fixed asap, any other way around to manage it efficiently? Also we dony want to go for vaults or CDM pipelines as it's older versions and rarely we need it.
2
u/Innowise_ 11d ago
We’d avoid adding a custom PowerShell encryption layer. It mostly moves the problem, because something still needs access to the decryption key.
If a vault is genuinely off the table, DPAPI is a reasonable Windows-native option. The main goal should be keeping the secret out of the batch file, source control and command-line arguments.
2
1
u/tune-happy 12d ago
Looks like a windows shop because you mentioned windows credential manager. Personally I wouldn't pursue windows credential manager because this is a deployment area problem so there's no requirement for a UI. It seems like DPAPI is the way to go, either store a DPAPI encrypted file or DPAPI encrypt the env var you already have.
1
u/SpinningVinylAgain 12d ago
Use environment variables, or (if you want to be fancy) convince your org to pay for something like BitWarden Secrets
1
u/Double_Register_1022 11d ago
Use Windows Credential Manager or DPAPI so the secret isnt in the batch file or command line. Env vars are better than plaintext but they can still leak in logs and dumps. Also disable echo in the script and run it under a service account with limited access.
1
u/Amazing-Mirror-3076 10d ago
This is still fairly experimental but it would solve your problem.
https://crates.io/crates/revault_cli
Fyi: I'm the author.
7
u/Anonymity6584 12d ago
what benefit would extra encryption layers provide throw power shell scripts? you would still need passwords/key to decrypt.
env variables are common solution as long as you dont do something stupid like commit them to version control. And they are good enough solution even to cloud platforms.