SessionOptions works in this respect the same way as native .NET NetworkCredential (it also has Password and SecurePassword properties).
**** I think this would be considered a risk. What if I wrote a script with the password written as plain text such as $password = 'Pa$$w0rd', is this considered good practice? Nope.
SessionOptions expose the password as plain text? It's even worse when the SecureString was used instead and it immediately decrypts it and presents it back to you.
winscp> open "sftp://myuser:***@10.1.0.1" -hostkey ssh1234
$sessionOptions.Password = "***"SessionOptions.SecurePassword as such as you could argue the use of System.Security.SecureString values within any PowerShell script.
SessionOptions the password is in plain view. Should you wish to make use of the information within SessionOptions for things such auditing, logfiles or pass the object to another process you have to be careful how to handle the object so not to expose the password value by other means. It's all about reducing the risk.
SessionOptions.Password? If that option was not available, what would prevent an attacker from reading the password from SessionOptions.SecurePassword?
...if I debug the script after theSessionOptionsobject has been initialized with theSecurePassword, I can see the decoded password as plain text in thePasswordproperty of theSessionOptions?
...
SecurePassword option and then making the password available to view in SessionOptions.
SessionOptions object has been initialized with the SecurePassword, I can see the decoded password as plain text in the Password property of the SessionOptions?
Read-Host 'Enter password' -AsSecureString |
ConvertFrom-SecureString |
Out-File 'C:\password.txt'
password.txt
$sessionOptions.Password = "BLBALBLBA"$sessionOptions.SecurePassword = ConvertTo-SecureString "01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d5e66e657ce0264d9cdffd82e583fec00000000002000000000003660000c00000001000000005351f863d78e0364289ed60022d65a30000000004800000a000000010000000467b753a60f8a4ef0b612880c92ec6c730000000b87f47ffd9c5bafbc1a2a3d39e520199e8b10cb571aa97cd9ec2c43b86fed4fb0c1e40d3b5fc81ecc04dd79f1f71f942140000001c829482c76164fa43e7af395ff2ca3db611821b"
param (
$localPath = "F:\Test-Sync01\",
$remotePath = "/Test-Sync01/"
)
try
{
# Load WinSCP .NET assembly
Add-Type -Path "F:\syncapp\WinSCPnet.dll"
# Setup session options
$sessionOptions = New-Object WinSCP.SessionOptions
$sessionOptions.Protocol = [WinSCP.Protocol]::Sftp
$sessionOptions.HostName = "server08"
$sessionOptions.UserName = "syncusr"
$sessionOptions.Password = "BLBALBLA"
$sessionOptions.SshHostKeyFingerprint = "ssh-rsa 1024 13:d3:ef:ee:4d:cc:22:31:04:aa:1e:cd:7b:c7:42:02"
$session = New-Object WinSCP.Session
try
{
# Connect
$session.Open($sessionOptions)
# Synchronize files to local directory, collect results
$synchronizationResult = $session.SynchronizeDirectories(
[WinSCP.SynchronizationMode]::Remote, $localPath, $remotePath, $False)
# Iterate over every download
foreach ($download in $synchronizationResult.Uploads)
{
echo $download.FileName
# Success or error?
if ($download.Error -eq $Null)
{
Write-Host ("Download of {0} succeeded, removing from source" -f
$download.FileName)
try
{
Remove-Item $session.EscapeFileMask($download.FileName)
Write-Host ("Removing of file {0} succeeded" -f
$download.FileName)
}
catch [Exception]
{
Write-Host ("Rmoving of file {0} failed" -f
$download.FileName)
}
}
else
{
Write-Host ("Download of {0} failed: {1}" -f
$download.FileName, $download.Error.Message)
}
}
}
finally
{
# Disconnect, clean up
$session.Dispose()
}
exit 0
}
catch [Exception]
{
Write-Host $_.Exception.Message
exit 1
}