Python：在脚本中保护敏感变量内容

Question

I need the user to input their password into my script so that I can then use that password to perform an LDAP operation on their account. It's very simple:

password = getpass.getpass()    
ldapconn.simple_bind_s(binddn, password)

Even though the password is never leaving the script and is never displayed in plain text, isn't it still vulnerable to something like a memory dump? What's the best way to secure this password within the script, but still make use of it?

This post is interesting: https://security.stackexchange.com/questions/29019/are-passwords-stored-in-memory-safe

Primarily because the answers confirm my suspicion that passwords stored in RAM are not safe. My question is, how is one supposed to do work that requires that sensitive information be stored in RAM? No one on that post really posts a practical real-world solution, just a lot of a confirmation and details as to why RAM is not safe. Using my short example of an LDAP connection above, what concrete changes could you make to better secure the password variable?

Answer 1

Using my short example of an LDAP connection above, what concrete changes could you make to better secure the password variable?

None. You either:

• Need to have the plain text to send to the LDAP API,
  • In which case you need to have the plain text, which an attacker could get
  • Or you need encrypted text which you decrypt, which an attacker could get after you decrypt it
• Need a password hash to send to the LDAP API
  • Then the attacker could get the hash and use it. It's effectively a plain password at that point.

The solutions which exist are to have a design which does not involve prompting the user for their password at all, and does not involve sending plain text passwords to other services.

eg you have a properly working Kerberos environment with synchronised time, users getting Kerberos tickets at first login, and those tickets being used to authenticate with services without password prompts. Tickets have a limited lifetime and Kerberos replay detection is built in, so that if they are taken from memory they are much less useful than a password.

So the user hits a password prompt once for the entire environment, not once per script they run or service they access, and that password is handled by one centralized, well reviewed, low level OS process.