Protecting credentials used for automation

When writing a script file or a code using .NET assembly, you need to store credentials (such as a username and a password) somewhere. Storing them in the script/code directly has obvious disadvantages, for example:

• The script/code is often stored in a revision control system, making the credentials easily accessible.
• The script/code may often need to be accessible on the production system for review or auditing purposes or reuse, while the credentials should not.

Solution is to separate the credentials from the script/code into a configuration file. While the script/code without explicit credentials can be safely stored into a revision system and be otherwise accessible, the configuration file should be protected as much as possible. Particularly its file permissions should be restricted only to administrators (for writing) and user under which the script/code runs (for reading). The configuration file can also be encrypted, for example with built-in NTFS filesystem-level encryption.

• Using WinSCP scripting
• Using WinSCP .NET assembly
  • PowerShell

option batch abort
option confirm off
open sftp://%USERNAME%:%PASSWORD%@example.com
...

@echo off
set USERNAME=martin
set PASSWORD=mypassword
winscp.com /script=example.txt

<Configuration>
  <UserName>martin</UserName>
  <Password>mypassword</Password>
</Configuration>

# Read XML configuration file
[xml]$config = Get-Content ".\config.xml"
 
# Use read credentials
$sessionOptions = New-Object WinSCP.SessionOptions
$sessionOptions.Protocol = [WinSCP.Protocol]::Sftp
$sessionOptions.HostName = "example.com"
$sessionOptions.UserName = $config.Configuration.UserName
$sessionOptions.Password = $config.Configuration.Password
 
...