I have a script that downloads bank transactions to store in a database. To get these transactions requires a password for each account. The database is encrypted and requires a key to access it. All these keys and passwords are themselves encrypted and require a master key to retreive. The script prompts for the master key, uses this to retrieve all the necessary passwords and keys, and then does its work.

Right now this script is being called manually. Automating it to run periodically is easy, except for the part of securing the master key. Simply storing it in a file in plaintext does not seem very secure, as anybody who manages to get read access to the file now has wide open access to a lot of sensitive information. Storing it in a way that the script has it (for example obfuscating it in a binary called by the script) won't work either, because then anyone who can execute the script has an attack vector there.

I have read this question, the answer there appears to be "store it in a file" with added comments suggesting not in plain text. But even if the password is not plain text, it still seems like we have to communicate to the script how to read the file somehow, such as a decryption key or something, and we are back at square one.

  • 1
    What kind of key? If it's gpg you could use something like gpg-agent.
    – jordanm
    Commented Dec 22, 2013 at 0:14
  • It's an AES-256 key.
    – Michael
    Commented Dec 22, 2013 at 0:59
  • 1
    What do you want to happen? Any method of automation will be exploitable. The root user can do anything.
    – phemmer
    Commented Dec 22, 2013 at 2:40
  • Well, minimizing the risk would be a good start.
    – Michael
    Commented Dec 22, 2013 at 6:42
  • Don't you need a password to authenticate to the database anyway? So this is not exactly a new problem. Commented Dec 22, 2013 at 15:08

3 Answers 3


Here is how I wound up solving the problem.

First, I created a separate key server that starts up at the same time as the main server. Its sole purpose is to hand out keys to authorized processes. It does this by running an md5sum on the calling binary, then seeing which keys that binary is allowed to access. The calling binary (in this case, the script, which has been compiled to an executable) requests the keys from this server and then proceeds as normal.

The key server runs all the time and maintains a keychain password in its own memory. On startup, it does not have the keychain password, and thus cannot respond to requests for keys. So before it can do this, it requires that the keychain password gets set. This can be done via a web interface or the command line and requires user interaction. This secures the system by requiring that somebody physically enter the correct password. This generally only needs to be done once per reboot, since the key server never terminates.


Put your keys in the environment as environment variables.

The way sites like Amazon aws and heroku recommend that you store sensitive information like keys and passwords are in environment variables.

Put the password in a text file that is readable only by you

Assuming this is a Mac or linux system:

touch foo.sh

Place the export in the file

nano foo.sh

export SOMESECRET=42

Then change the permissions

chmod 700 foo.sh

Then source the file

source foo.sh

The secret will only be available in that shell and subshells


Store it in the database. If you are storing unencrypted bank transactions in the database, and someone has access to the database, then they can see the bank transactions anyway, so they don't need the master key.

Unless of course the master key does other stuff besides just accessing the data... but that would be bad security practice anyway.

  • The database is not un-encrypted.
    – Michael
    Commented Dec 22, 2013 at 14:58
  • I'm a little confused. How many databases are there here? 1? 2? Are you retrieving from, and storing into, the same database? Commented Dec 22, 2013 at 15:06
  • Two databases, both encrypted. One stores the key to the other, as well as passwords. The other stores transaction re cords.
    – Michael
    Commented Dec 22, 2013 at 15:14
  • Where does the output of your script go? Your question says "to store in a database". Which one? Commented Dec 22, 2013 at 15:17
  • The second one.
    – Michael
    Commented Dec 22, 2013 at 15:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .