I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a Pyro connection to this daemon and execute methods from the daemon, none of which reveal or have access to the password:
my_daemon.py:
import getpass
import Pyro.core
password = getpass.getpass()
class TestDaemon(Pyro.core.ObjBase):
def __init__(self):
Pyro.core.ObjBase.__init__(self)
def do_some_stuff(self):
return "I am a method which would do some stuff, utilizing password \"{0}\" which is only accessible from this daemon.".format(password)
Pyro.core.initServer()
daemon=Pyro.core.Daemon()
uri=daemon.connect(TestDaemon(), "TestDaemon")
daemon.requestLoop()
driver.py:
import Pyro.core
my_daemon = Pyro.core.getProxyForURI("PYROLOC://localhost:7766/TestDaemon")
print my_daemon.do_some_stuff()
# note: the password variable in the daemon is inaccessible from here.
I would like advice on how secure this is, and what steps I can take to increase security. I know, for example, that this is not 100% fool proof --- if someone were able to dump the memory, the password would probably be accessible that way. That's an unfortunate one I'm willing to live with. What else?
The "storing-password-in-memory-via-daemon" pattern is not something I can deviate from. This approach was decided on by the team as a whole (as opposed to putting the password in a root read-only text file for example). So it's less a matter of, "what alternatives do I have," and more a matter of, "what tools can I use to accomplish this particular task with the simplest and easiest to maintain code without sacrificing too much security?"