Storing passwords for usage in scripts

Question

There are few situations that require users to provide their password while automating things during development process. Site deployment is only one of the common situations. Creating dmg files under OS X requires password as well. Most of the command line utilities used in scripts has an ability to receive a password via stdin.

Providing password each time the script is run kinda defeats the purpose of "automatic". Storing it plain text in the script defeats the purpose of "password". What is the most optimal approach to providing passwords to scripts that requires them?

Answer 1

Without knowing more specifics about this particular situation, it seems as though you are unable to "have your cake and eat it too". If there is no other option (my disclaimer here is that I'm unfamiliar with OS X), then you need to choose between automation and security.

Who has access to these dmg files? If administrators or trusted users are the only ones, then you are probably fine with storing this passwords in plain text, as long as these are dedicated passwords and don't extend beyond the necessity of the script completion.

Is this a truly unattended script? If it is not, and it's a minor inconvenience to input a password, then you may be better off just sucking it up and entering in the password as the only step for these script files.

Again, somebody with OS X experience might give more applicable suggestions, but a general rule of thumb for security is deciding which is more important (security vs. adminsitration) for the given situation/environment.

Answer 2

Put it in a separate configuration file only accessible to you, and let your scripts read in said configuration file at execution time.

Answer 3

If the purpose of the password is to ensure the operation is authorized by the person trusted with the password, then it makes no sense to attempt to bypass it or automate it.