I am developing an application where one can add SSH credentials for servers and then an automated python script can fetch those credentials to login to the server and perform certain automated tasks.

The issue that I am facing is how to securely store the SSH credentials on my server so that the python script can securely retrieve those credentials and perform its tasks. Also, since multiple server's credentials would be saved on my application, if my server gets compromised, the attacker would get access to a lot of servers

I obviously cannot hash the passwords as the python script would require the actual password to login to the server. What could be the recommended approach and cryptographic algorithms that I can use to securely store all the credentials.

  • 2
    If you talk about storing client private key, the recommendation is "no". Cluod services like AWS, etc won't store the private key. If one make a mistake and render server inaccessible through ssh, those user should mount their storage from another system and fix from there. – mootmoot May 18 '18 at 11:51

Please do not do this. At all. Or any variation of it.

If you continue to take this route, you will have a nasty breach to clean up. On a long enough time-scale, it's a certainty.

The only proper way to store any passwords is in a salted hash with very restrictive permissions, which cannot be used for what you're asking. In order to store credentials, you will need to lock it down to a single user or root account and chmod it to 400. You could, in theory, run the python script as a specific user (or service account) and make THAT user the owner of the file, but again - storing passwords in plain text is never, under any circumstances, a good idea, because file permissions can be abused. If someone were to compromise your server and obtain root, they chould change them anyway and you've now gone from a single compromised server to many compromised servers. However, one would likely not even need to obtain root to see this file if you don't configure it properly.

If you are storing passwords for other servers, you would do much better to use a keypair. Keep the private key on the remote server and use ssh-copy-id to send the pub key to the server you're storing keys on. While this does not achieve your end of storing a password, it is the most safe method of storing credentials for multiple other servers.

| improve this answer | |
  • Could you please explain why he shouldn't do this? All you've said is "don't do it there are consequences" this is an unhelpful answer at best it's a comment... Please revise the answer. You need to explain why it is bad and what consequences will follow... – J.J May 18 '18 at 16:58
  • So, you believe that all password managers should be trashed? – schroeder May 18 '18 at 17:11
  • No, but this is asking how to keep passwords for grabbing it for a script, not how to store passwords for say, a browser. Based on how the question is asked, if you used a password manager in a script, you'd have to hard code the password into the script, which would defeat the purpose anyway. – SomeGuy May 18 '18 at 17:14
  • If you know of a way to use a password manager for this purpose, I'll happily delete my post and up-vote yours. – SomeGuy May 18 '18 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.