Securing Password in EG Python Script

[aldi13]

Background = Very limited programming knowledge:

I have a basic Python Script that call's an automation resource. I need the script to be able to authenticate in order to execute the request. I am currently using base64 to encode the password. Obviously this is not very secure. Is there a way that I can better secure my password in the Python script?

Thanks in advance to those Python experts out there.

Part of the Script:

Code: Select all

import urllib2
import sys
import base64

username = 'vvvvvvv'
password = base64.b64decode("vvvvvvvv")

auth_handler = urllib2.HTTPPasswordMgrWithDefaultRealm()
auth_handler.add_password(None, uri='http://192.168.1.28',user=username,passwd=password)
handler = urllib2.HTTPBasicAuthHandler(auth_handler)

print (responce)

[krambriw]

I think you will have to look into encryption variants. I have not tried myself though. I would myself look at the PYCRYPTO samples if I needed encryption.

https://launchkey.com/docs/api/encryption

[krambriw]

Actually, Google is helping out. Here is a script that works in EG as a python script. You find explanations here:
http://www.codekoala.com/posts/aes-encr ... -pycrypto/

Code: Select all

#!/usr/bin/env python

from Crypto.Cipher import AES
import base64
import os

# the block size for the cipher object; must be 16, 24, or 32 for AES
BLOCK_SIZE = 32

# the character used for padding--with a block cipher such as AES, the value
# you encrypt must be a multiple of BLOCK_SIZE in length.  This character is
# used to ensure that your value is always a multiple of BLOCK_SIZE
PADDING = '{'

# one-liner to sufficiently pad the text to be encrypted
pad = lambda s: s + (BLOCK_SIZE - len(s) % BLOCK_SIZE) * PADDING

# one-liners to encrypt/encode and decrypt/decode a string
# encrypt with AES, encode with base64
EncodeAES = lambda c, s: base64.b64encode(c.encrypt(pad(s)))
DecodeAES = lambda c, e: c.decrypt(base64.b64decode(e)).rstrip(PADDING)

# generate a random secret key
secret = os.urandom(BLOCK_SIZE)

# create a cipher object using the random secret
cipher = AES.new(secret)

# encode a string
encoded = EncodeAES(cipher, 'password')
print 'Encrypted string:', encoded

# decode the encoded string
decoded = DecodeAES(cipher, encoded)
print 'Decrypted string:', decoded

[krambriw]

And by the way, I see that you are using a HTTP connection. If possible, you shall change and start using HTTPS.

To support HTTPS connections in python, I would recommend to use Requests. It is not included in EG dist but can be downloaded and installed and then also available in EG.

But it depends what you really would like to achieve. You write protect passwords but is that really the thing you like to achieve? Or do you want a secure communication established???

Check out this link

http://docs.python-requests.org/en/latest/

[aldi13]

Thanks for the reply. Yes I would also like to switch to HTTPS which is supported by the device I am connecting too but did not know how to get it to work. Thanks for pointing me in the right direction. Let me see if I can figure this out.