Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a Pyro connection to this daemon and execute methods from the daemon, none of which reveal or have access to the password:

import getpass
import Pyro.core

password = getpass.getpass()

class TestDaemon(Pyro.core.ObjBase):
   def __init__(self):
   def do_some_stuff(self):
      return "I am a method which would do some stuff, utilizing password \"{0}\" which is only accessible from this daemon.".format(password)

uri=daemon.connect(TestDaemon(), "TestDaemon")

import Pyro.core
my_daemon = Pyro.core.getProxyForURI("PYROLOC://localhost:7766/TestDaemon")
print my_daemon.do_some_stuff()
# note: the password variable in the daemon is inaccessible from here.

I would like advice on how secure this is, and what steps I can take to increase security. I know, for example, that this is not 100% fool proof --- if someone were able to dump the memory, the password would probably be accessible that way. That's an unfortunate one I'm willing to live with. What else?

The "storing-password-in-memory-via-daemon" pattern is not something I can deviate from. This approach was decided on by the team as a whole (as opposed to putting the password in a root read-only text file for example). So it's less a matter of, "what alternatives do I have," and more a matter of, "what tools can I use to accomplish this particular task with the simplest and easiest to maintain code without sacrificing too much security?"

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.