Currently, I've many scripts that need to log in as superuser to automate many tasks. (For example, creating tables in databases, creating other users, etc.)
Instead of having the credentials (especially the passwords) stored directly in the script, I'm reading them from a file (call it pwds.txt), which can be accessed only by root user.
Some of my colleagues say that a more secure approach is to have the password encrypted in pswds.txt, hide the key somewhere and decrypt the encrypted data in the script before I use it.
I claim that it just reduces the problem into finding where key is located, which doesn't seem hard at all to and adversary that can read the script. I think that this process just complicates the programming without actually providing any real layer of protection.
- Who is more correct, me or them? (and why)
- I know that 100% security doesn't exist, but what are the best practices for my problem?