1

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server.

My questions are:

  1. Is there any security concern about running an auto-login script on the server side?
  2. How can I store usernames and passwords securely?
  • 2
    Everyone with access to the server will have access to the password too. Focus on securing the whole server (and, if necessary, don't rely on hosters) – deviantfan Feb 12 '16 at 6:31
  • No, a key point to be addressed in any answer is ensuring that "everyone with access to the server" will not have access to the credentials - as per the answer below from jas. Privilege seperation is the most fundamental security feature n a multi-user system. – symcbean Oct 9 '16 at 20:29
1

This is extremely common practice already, think database connections on servers with most keys stored in plain text on the server, there is little way around it.

You just have to prepare your self for automation:

  1. Ensure the connection is only 443 (SSL or what ever port the SSL is on for this service)
  2. if you access the server physically ensure you only have the required ports open to complete the tasks the server requires.
  3. if you have to SSH to the server ensure you use a password and a cert for the connection

it is as the comments say, secure the server and its activities, do not focus on the password, just ensure its not in a publicly touchable file (away from any web servers) and read only for the user who needs to read it with no permissions to anyone else.

The only list of concerns would be this:

  1. automated logins mean automated connections, you need to ensure you are not getting MitM attacked by putting extra security in, its easier to attack an automated connection (no one there to read the warnings!!)
  2. Where, when and who can read that password file.
  3. security of the server and who can access it

dont forget to ensure that all your passwords are randomly generated and stored in an encrypted keychain if you have a cert then 8 random characters will be enough :)

1

Set the file permissions to 0440 that hold the credentials.

Set the script doing the heavy lifting to 0741.

Setup a non privileged user and group.

The script doing the heavy lifting as a scheduled task will be executed as a root user just long enough to open and read the credential file before dropping privileges to the non-privileged account.

While it may seem like overkill setting the correct permissions on configuration and user scripts from the start will help protect your env.

Privilege dropping is common for services

  • Mostly good advice apart from running as root which is completely unnecessary, and potentially risky. – symcbean Oct 9 '16 at 20:31
1

How could someone exploit the facility?

  • by reading the network packets
  • by tricking the client program into connecting to the wrong server
  • by reading the file the credentials are stored in
  • by interfering with the program used to read the credentials normally
  • by retrieving the file from a backup
  • by rebooting the server from a usb key or cd and reading the files.

Without knowing much about the application its hard to advise what might be appropriate. But in most cases it should sufficient to:

  • ensure you use https terminated at the client and enforcing server verification to connect to the service
  • create a dedicated user for reading the credentials and carrying out the exchange
  • ensure the credentials file is only readable by the dedicated runtime user and the user who will manage the credentials. E.g. rw-r----- manager group where group only contains manager and the runtime user.
  • ensure that only the manager can modify the code being run.

How you protect your backups and prevent booting from other media depends on a lot of information we don't know.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.