#🔒 How do you store credentials locally for a cron job

12 messages · Page 1 of 1 (latest)

wheat elm
#

So I have a cron job that executes every so often that logs into devices remotely.

obviously i can store them in a file and just read that file. this job would run as root so if i made it read only that locks it down but still not secure.

i looked into encrypting stuff with python and it's doable but then you have a chicken and the egg scenario --- how do you store the password to decrypt that password lol

you could use locally generated certificates, but that's just obfuscation

tender surgeBOT
#

@wheat elm

Python help channel opened

Remember to:

  • Ask your Python question, not if you can ask or if there's an expert who can help.
  • Show a code sample as text (rather than a screenshot) and the error message, if you've got one.
  • Explain what you expect to happen and what actually happens.

:warning: Do not pip install anything that isn't related to your question, especially if asked to over DMs.

Closes after a period of inactivity, or when you send !close.
smoky solstice
# wheat elm So I have a cron job that executes every so often that logs into devices remotel...

I'm not exactly qualified to give out security advice, but there are a few steps you can take to help make this more secure. I would set up a new user on the remote device that has almost no permissions except to do this one thing, even removing shell access if you can get by without it. Then, I wouldn't log into the server with username/password, instead I'd set up ssh keys and encrypt the ssh keys with a password. Next, I wouldn't be running this with root, I would set up a new local user as well. But yes, ultimately the sshkey password (potentially loaded as an environmental variable in the bashrc or something) and ssh private key would need to be readable by that new local user, so if that user was compromised someone else might be able to access that other server. You could also lock down which computers can access the remote server as well by mac address or network filtering or other techniques.

wheat elm
# smoky solstice I'm not exactly qualified to give out security advice, but there are a few steps...

a bit more context - it's accessing routers, switches, firewalls and it's a read only account that uses tacacs (which is ldap enabled)

it pretty much has to run as root for the cron job because it executes a docker run command (loads the container with the correct environment)

I'm thinking about this and if I store my private key locally it's essentially the same security level as a root user storing a certificate locally

maybe I'm over thinking this

smoky solstice
#

Yes, docker run commands can be tricky. You could set up rootless docker, though I ran into issues trying to get that to work. If you want to run the docker image without root, I'd probably suggest using podman instead.

#

Which is compatable with docker images and its open source

limber hamlet
#

explain more of the function of this, its a cronjob so it runs on a schedule correct?
then users would inly need the output no?

#

lock away the backend, and give the users a place to only retrieve the output.

pseudo basin
limber hamlet
#

i personally do this type of thing and just use a dict where no one has access to the script expect administators.. whom already have the pw lists.
I then dump all the output files to an ftp to be read by other various 3rd party apps like sharepoint etc.

tender surgeBOT
#
Python help channel closed for inactivity

This help channel has been closed. Feel free to create a new post in #1035199133436354600. To maximize your chances of getting a response, check out this guide on asking good questions.