PowerShell to use WinSCP .NET assembly with secure credentials

Question

I'm trying to use WinSCP .NET assembly with secure credential, when the password secured in external file.

# Load WinSCP .NET assembly
Add-Type -Path "D:\WinSCPnet.dll"

# Setup session options
$sessionOptions = New-Object WinSCP.SessionOptions
$sessionOptions.Protocol = [WinSCP.Protocol]::Sftp

# Env
$sessionOptions.HostName = "blabla.com"
$sessionOptions.UserName = "UUUU"
#$sessionOptions.Password = "PPPP"
$sessionOptions.SshHostKeyFingerprint = "XXXXXXXXX"
$remotePath = "/home/UUUU/"

With hard coded password its working. If I would like to use securestring for the password, how should I do that?

I tried:

read-host -assecurestring | convertfrom-securestring | out-file D:\securestring.txt

To keep the secure password in a file. Then, in my script, I get it back:

$sessionOptions.Password = get-Content D:\securestring.txt | convertto-securestring

$Cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $sessionOptions.UserName, $sessionOptions.Password}

But it's not working...

Martin Prikryl · Accepted Answer · 2025-02-20 12:02:19Z

5

The assembly supports password in a form of SecureString using the SessionOptions.SecurePassword.

See https://winscp.net/eng/docs/library_sessionoptions#securepassword

Thanks for inspiring this improvement.

While the assembly keeps the password encrypted in memory, it still needs to decrypt it eventually. Improvements to limit internal copies of the decrypted password are pending.

edited Feb 20 at 12:02

answered Oct 9, 2014 at 13:17

Martin Prikryl

205k64 gold badges560 silver badges1.1k bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2017-05-23 12:02:05Z

2

As @Matt pointed out, the WinSCP .Net assembly doesn't accept secure strings or credential objects. You need to pass the password as a plaintext string. You can store the secure string in a file, though:

Read-Host 'Enter password' -AsSecureString |
  ConvertFrom-SecureString |
  Out-File 'C:\password.txt'

and use a PSCredential object to retrieve the decrypted password from the secure string after you read it from the file:

$un   = 'username'
$pw   = Get-Content 'C:\password.txt' | ConvertTo-SecureString
$cred = New-Object Management.Automation.PSCredential $un, $pw

try {
  Add-Type -Path 'WinSCPnet.dll'

  $opt = New-Object WinSCP.SessionOptions
  $opt.Protocol = [WinSCP.Protocol]::Sftp
  $opt.HostName = 'example.org'
  $opt.UserName = $cred.UserName
  $opt.Password = $cred.GetNetworkCredential().Password
  $opt.SshHostKeyFingerprint = 'ssh-rsa 2048 ...'

  $sftp = New-Object WinSCP.Session

  $sftp.Open($opt)
  ...
} catch {
  ...
} finally {
  if ($sftp) { $sftp.Dispose() }
}

WinSCP sample code taken from the documentation.

Note, however, that the password must be saved by the same user who is running the SFTP PowerShell script, because the encryption key is derived from that user's password.

edited May 23, 2017 at 12:02

CommunityBot

11 silver badge

answered Oct 5, 2014 at 15:58

Ansgar Wiechers

202k27 gold badges286 silver badges363 bronze badges

2 Comments

Martin Prikryl Over a year ago

WinSCP .NET assembly already supports SecureString, see my answer.

Ansgar Wiechers Over a year ago

It didn't at the point when I was writing my answer, before you added SecureString support. ;) Thank you very much for your work, BTW.

Matt · Accepted Answer · 2014-10-06 11:26:22Z

1

According to WinSCP the password property just supports a string. So trying to pass a secure string will not work. If you really want to store the password in a file, you could attempt to store it as the secure string but that is a really bad idea in general since it can be unsecured just as easily (Also not sure if it is possible). I recommend the following option.

# Only stored in memory which is safer.
$sessionOptions.Password = read-host

If you have your heart set on something else you could try this. Just know for previous reasons I do not condone this. Also i have to see if it even works because it looks like you cant output securestring to file.

read-host | out-file D:\securestring.txt
$sessionOptions.Password = get-Content D:\securestring.txt

Ansgar's explains what I didn't know was possible. You can stored the secure string in a file and use it elsewhere.

edited Oct 6, 2014 at 11:26

answered Oct 5, 2014 at 12:39

Matt

47k9 gold badges90 silver badges125 bronze badges

1 Comment

Martin Prikryl Over a year ago

WinSCP .NET assembly already supports SecureString, see my answer.

Collectives™ on Stack Overflow

PowerShell to use WinSCP .NET assembly with secure credentials

3 Answers 3

Comments

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related