use encrypted password as parameter for CMD in Powershell

Question

I am trying to execute an Oracle EXPDP(Oracle Data Pump) command through Powershell, using an encrypted password file so I can keep my database password out of my git repo. Here's what my code to generate the file looks like:

"Password1" | ConvertTo-SecureString -AsPlainText -Force | ConvertFrom-SecureString | Out-File "C:\Backups\dbPassword.txt"

Obviously Password1 isn't the actual password, but you get the idea...

I want to write a script to decrypt that file, then take the decrypted "Password1" value and use it in the expdb command as my db password. Here's what I've come up with so far:

$dbPassword =  cat C:\backups\dbPassword.txt | convertto-securestring -AsPlainText -Force
$timeStamp = "$(get-Date -f MMddyyyy)"
$expdb = 'EXPDP'
$dbCredential = 'system/'+$dbPassword
$expdbDirectory = 'directory=backups'
$expdbFull = 'full=Y'
$expdbDRFileNamePrefix = 'EXPALL_DR_' + $timeStamp
$expdbDRFileNameDMP = $expdbDRFileNamePrefix + '.DMP'
$expdbDRFileNameLOG = $expdbDRFileNamePrefix + '.log'
$expdbDRFile = 'file=' + $expdbDRFileNameDMP
$expdbDRLog = 'log=' + $expdbDRFileNameLOG

$command = $expdb + ' ' + $dbCredential + ' ' + $expdbDirectory + ' ' + $expdbFull + ' ' + $expdbDRFile + ' ' + $expdbDRLog

Invoke-Expression $command

When I execute this, I get the following error:

EXPDP : 
At line:1 char:1
+ EXPDP system/System.Security.SecureString directory=backups full=Y fi ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError

Export: Release 11.2.0.1.0 - Production on Fri Oct 14 16:09:55 2016
Copyright (c) 1982, 2009, Oracle and/or its affiliates.  All rights reserved.
UDE-01017: operation generated ORACLE error 1017
ORA-01017: invalid username/password; logon denied
Username:

I assume I need to use the equivalent of a "toString" command to make it fully plain text for the command line. Anyone know what this is, or if there's a way to use the PSCredential object to do this?

Thanks!

why encrypt the file? if you .gitignore the file, you might as well just keep the pw plaintext and bypass this problem. — Marc B
– Marc B, Commented Oct 14, 2016 at 20:22
so leave the password as plain text on the server, but ignore it in git? I suppose, but encrypting it provides some additional security, even if it is simply security through obscurity. — Adam Blomeke
– Adam Blomeke, Commented Oct 14, 2016 at 20:24
An encrypted password doesn't magically decrypt itself just because you want it to. Your commandline expects a plaintext password anyway, so there's no point at all in reading an unencrypted password from a file, encrypt it, then decrypt it again to be actually abel to use it. — Ansgar Wiechers
– Ansgar Wiechers, Commented Oct 14, 2016 at 20:33
I guess we are outputting to a logfile anyway, which would be in plain text, so this makes sense. I just don't like having plain text passwords sitting out there. Unavoidable sometimes I suppose. I'd accept that as an answer if you want to write it up as one. — Adam Blomeke
– Adam Blomeke, Commented Oct 14, 2016 at 20:44
Depending on your infrastructure, the easiest and most wide ranging solution to this is to use a service account along with externally identified users (windows trusted authentication) in Oracle. No password required as it uses the service account to log in. — Nick.Mc
– Nick.Mc, Commented Sep 25, 2017 at 2:16

Community · Accepted Answer · 2017-05-23 12:10:48Z

5

The password doesn't decrypt itself, so you'd need to do it yourself. The easiest way to do this, is to create a PSCredential object, as @briantist suggested. It allows to retrieve the (unencrypted) password via its GetNetworkCredential() method.

$dbPassword = Get-Content 'C:\backups\dbPassword.txt' |
              ConvertTo-SecureString -AsPlainText -Force
$cred = New-Object Management.Automation.PSCredential('system', $dbPassword)
...
$command = $expdb + ' ' + $cred.UserName + '/' +
           $cred.GetNetworkCredential().Password + ...

However, you're storing the unencrypted password in a file, and your external command seems to expect plaintext credentials anyway, so I don't see a point in encrypting the password during the transfer from file to command. That would be like building a gate in the middle of an empty place.

edited May 23, 2017 at 12:10

CommunityBot

11 silver badge

answered Oct 14, 2016 at 21:03

Ansgar Wiechers

202k27 gold badges286 silver badges363 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Adam Blomeke Over a year ago

This is close. I need to do some debugging, but I'll edit this answer when I get it right next week. It's the end of the workweek for me though.

briantist Over a year ago

Haha that photo 😂

Ansgar Wiechers Over a year ago

Glad you like it ;)

Adam Blomeke Over a year ago

I finally got it. The answer is found here:

Adam Blomeke Over a year ago

blogs.msdn.microsoft.com/timid/2009/09/10/…

Graham · Accepted Answer · 2017-09-25 02:13:19Z

0

I wonder if the problem is your password itself. You have to be careful about what special characters are in the password. For example, an ampersand & or a pipe | or redirection characters <> or quotes ' (especially double "), and even caret ^ may cause problems because they are special characters for the command interpreter. How you escape each of these will be different, so it depends on which ones you have.

You might try the same thing first with a very simple password to see if it works, and if so you can start with a password containing only alphanumerics and then add special characters one at a time to see if they work.

edited Sep 25, 2017 at 2:13

Graham

7,86020 gold badges67 silver badges92 bronze badges

answered Oct 14, 2016 at 20:33

briantist

48.3k6 gold badges94 silver badges139 bronze badges

9 Comments

Ansgar Wiechers Over a year ago

The OP wants to run an external command (expdp) which seems to expect plaintext credentials. I fail to see how a PSCredential is going to help here.

Adam Blomeke Over a year ago

Good things to note, though in this case, the most complex characters in the file are, ! and ?. The rest are numbers and letters. The file looks fine though as an encrypted string.

briantist Over a year ago

@AnsgarWiechers if he still wants to store it encrypted (sometimes you can't restrict access to the filesystem as well as to the executing code, want to minimize possibility for exposure, or has to deal with certain regulations), it's easier with a [PSCredential] to export it / import it since the encryption/decryption is done for you, and with .GetNetworkCredential() it's also easier to get at the unencrypted password. If he opts to store it plaintext as you suggested in the comments then this is all moot but I'm addressing the situation where it remains encrypted on disk.

Adam Blomeke Over a year ago

@briantist This isn't a windows or Active Directory password. This is a password for Oracle. Does PSCredential work the same with that?

Adam Blomeke Over a year ago

I think I see it.

|

Collectives™ on Stack Overflow

use encrypted password as parameter for CMD in Powershell

2 Answers 2

5 Comments

9 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

9 Comments

Your Answer

Sign up or log in

Post as a guest

Related