rmbolger / Posh-IBWAPI

PowerShell module for interacting with the Infoblox WAPI (REST API).
MIT License
54 stars 8 forks source link

Add an option for persisting WAPI config data #20

Closed rmbolger closed 6 years ago

rmbolger commented 7 years ago

Set-IBWAPIConfig is great for saving connection details in the current Powershell session. But it would be nice if you could optionally save those details in the user's local profile so they are loaded automatically whenever the module is loaded.

There are obviously security implications in saving Infoblox credentials to the filesystem. But using something like Export-CliXml that utilizes DPAPI for encryption under the hood might be sufficient protection.

rmbolger commented 6 years ago

With PowerShell Core now in the mix, there's now a wrinkle with this plan. DPAPI isn't supported on anything except Windows. And in the current 6.0.0 release of PowerShell Core, all cmdlets that depend on DPAPI like Export-CliXml throw an ugly error message on non-Windows platforms regarding not being able to load "CRYPT32.dll".

The PowerShell specific issue can be found here: PowerShell/PowerShell#1654 But ultimately, it depends on a closed CoreFX issue here: dotnet/corefx#22510

So basically, non-Windows platforms can't persist secrets with the same level of security as DPAPI provides. So do we try to obfuscate them manually? Just save them as clear text? Disallow saving credentials entirely?

My current preference is to still at least try to obfuscate them and maybe throw a warning that they're not as secure on the affected platforms?

rmbolger commented 6 years ago

For the time being, I think we'll just base64 encode the password on non-Windows platforms. And if the PowerShell team ever figures out a workaround to get these DPAPI dependent cmdlets working, we'll switch over to using them.

rmbolger commented 6 years ago

Added with v1.3 release