Encrypting powershell passwords

Question

I have a powershell script that connects to a MySQL database - Of course this connection needs a password and I would like to encrypt the password in some way, as opposed to storing the password as plain text.

I have looked into the securestring methods, outputting the password to a file, however I don't think they will work because the encrypted password can only be decrypted by the original user, and the script is going to be distributed onto a number of machines across the network.

Any suggestions on any other methods that would be useful?

Thanks

Answer 1

If the script is going to be distributed onto a number of machines across the network then every credentials that your script is going to use will be accessible to those users and there is no way around it.

You can do two things if there are any private per-user data:

1. create a new user account in the database for every user of your program with restrictive permissions allowing them to do only the things that you want them to do and nothing more
2. have a proxy server that would authenticate them and connect to the database in their name (this is how most websites work)

If all of the data is public and read-only then you can either:

1. create a user account in the database for read-only access and use its credential in all of the distributed copies of your program
2. have a proxy server that doesn't authenticate users but connects to the database instead of exposing it to the public

Number 2 of every one of those options is generally recommended for every database with a security history of MySQL, but number 1 of both of those options would be recommended for databases like CouchDB.

Never distribute any credentials with your program that you don't want your users to use.