Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a Pyro connection to this daemon and execute methods from the daemon, none of which reveal or have access to the password:

my_daemon.py:

import getpass
import Pyro.core

password = getpass.getpass()

class TestDaemon(Pyro.core.ObjBase):
   def __init__(self):
      Pyro.core.ObjBase.__init__(self)
   def do_some_stuff(self):
      return "I am a method which would do some stuff, utilizing password \"{0}\" which is only accessible from this daemon.".format(password)

Pyro.core.initServer()
daemon=Pyro.core.Daemon()
uri=daemon.connect(TestDaemon(), "TestDaemon")
daemon.requestLoop()

driver.py:

import Pyro.core
my_daemon = Pyro.core.getProxyForURI("PYROLOC://localhost:7766/TestDaemon")
print my_daemon.do_some_stuff()
# note: the password variable in the daemon is inaccessible from here.

I would like advice on how secure this is, and what steps I can take to increase security. I know, for example, that this is not 100% fool proof --- if someone were able to dump the memory, the password would probably be accessible that way. That's an unfortunate one I'm willing to live with. What else?

The "storing-password-in-memory-via-daemon" pattern is not something I can deviate from. This approach was decided on by the team as a whole (as opposed to putting the password in a root read-only text file for example). So it's less a matter of, "what alternatives do I have," and more a matter of, "what tools can I use to accomplish this particular task with the simplest and easiest to maintain code without sacrificing too much security?"

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.