[PowerShell每日技巧]导出/导入敏感信息(20140328)

DAIC

Credential objects contain a username and a password. You can create them using Get-Credential, and then supply this object to any cmdlet that has the -Credential parameter.

However, what do you do if you want your scripts to run without user intervention yet securely? You do not want a credentials dialog to pop up, and you do not want to store the password information inside the script.

Here's a solution: use the function Export-Credential to save the credential to file:

1. function Export-Credential
   
2. {
   
3.    param
   
4.    (
   
5.      [Parameter(Mandatory=$true)]
   
6.      $Path,
   
7. 
   
8.      [System.Management.Automation.Credential()]
   
9.      [Parameter(Mandatory=$true)]
   
10.      $Credential
    
11.    )
    
12. 
    
13.   $CredentialCopy = $Credential | Select-Object *
    
14.   $CredentialCopy.Password = $CredentialCopy.Password | ConvertFrom-SecureString
    
15.   $CredentialCopy | Export-Clixml $Path
    
16. }

复制代码

This would save a credential for the user tobias to a file:

1. Export-Credential -Path $env:temp\mycred -Credential mycomany\tobias

复制代码

Note that while you do this, the credentials dialog pops up and securely asks for your password. The resulting file contains XML, and the password is encrypted.

Now, when you need the credential, use Import-Credential to get it back from file:

1. function Import-Credential
   
2. {
   
3.    param
   
4.    (
   
5.      [Parameter(Mandatory=$true)]
   
6.      $Path
   
7.    )
   
8. 
   
9.   $CredentialCopy = Import-Clixml $path
   
10.   $CredentialCopy.password = $CredentialCopy.Password | ConvertTo-SecureString
    
11.   New-Object system.Management.Automation.PSCredential($CredentialCopy.username, $CredentialCopy.password)
    
12. }

复制代码

So use it like this:

1. $cred = Import-Credential -Path $enc:temp\mycred
   
2. Get-WmiObject -Class Win32_BIOS -ComputerName server1 -Credential $cred

复制代码

The "secret" used for encryption and decryption is your identity, so only you (the user that exported the credential) can import it again. No need to hard-code secrets into your script.

http://powershell.com/cs/blogs/tips/archive/2014/03/28/exporting-and-importing-credentials-in-powershell.aspx