Dell Command PowerShell Provider Secure Password feature

Affected Products:

• Dell Command | PowerShell Provider

The concept behind secure passwords is that in production scripts they should not pass important passwords as plain view. This is a serious lack of security. So, using PowerShell can secure a password or at least reduce password visibility. First, let us discuss general aspects of secure string and then discuss how DCPP leverages the innate feature of PowerShell to secure password.

Consider that you want to read the username and password from the user at the console. It is known that the username generally does not require any security and it can be visible to all. But for password you do not want to let strangers know the user’s password. This requirement can be facilitated with the commands as below:

$user = Read-Host "Enter Username"

$pass = Read-Host "Enter Password" -AsSecureString

The above is an overview of how more security can be added for more secure critical information like a password. In the example above, the variable $pass is of type System.Security.SecureString. Next, you get an introduction to two other widely used cmdlets PowerShell provides to facilitate secure fields before touching upon aspects of DCPP.

The two commands are ConvertTo-SecureString and ConvertFrom-SecureString. ConvertTo-SecureString converts a plain text to type System.Security.SecureString. An example is shown below:

"P@ssword1" | ConvertTo-SecureString -AsPlainText -Force

In the above example, the plain text P@assword1 is converted to type System.Security.SecureString. This is more of an information and may or may not be widely used.

The next cmdlet ConvertFrom-SecureString is a more widely used cmdlet which is used to convert secure strings into encrypted standard strings. The main limitation of ConvertTo-SecureString is that its output cannot be directly written into a file for future use. You must use ConvertFrom-SecureString which converts System.Security.SecureString into an encrypted standard string which can be conveniently saved to a file, to overcome this limitation.

You are converting plain text P@ssword1 to secure string and then piping its output to ConvertFrom-SecureString to get an encrypted string which can safely and conveniently be saved into a file.

As an example, let us say on a computer if the admin password has been set and must be saved to a file. This is done using:

Read-Host "Enter Admin Password" -AsSecureString |
ConvertFrom-SecureString | Out-File "C:\Scripts\AdminPassword.txt"

This command can retrieve back this admin password into a variable as a secure object such as:

$pass = Get-Content "C:\Scripts\AdminPassword.txt" | ConvertTo-SecureString

Now to consider how to leverage a secure password for DCPP. In DCPP, if the user’s computer has either System or Admin password set then for all set commands you must pass the respective password. So, providing this password as plain text breaches security. You must pass the password as System.Security.SecureString. Also, when you pass a SecureString password you must pass it with a -PasswordSecure switch and not the normal –Password switch. An example is shown below where the user is trying to set AdvancedBatteryChargeCfg to Disabled and passing SecureString password:

Set-item AdvancedBatteryChargeCfg disabled –PasswordSecure $pass

Here $pass holds the system and admin password and is of type System.Security.SecureString. Similar to the above discussion you can read $pass as:

$pass = Read-Host "Enter system/admin password" –AsSecureString

You can save $pass to a file, if required, as:

$pass| ConvertFrom-SecureString | Out-File "C:\Scripts\AdminPassword.txt

Related Articles:

• Dell Command PowerShell Provider Advanced Battery Charge feature
• Dell Command PowerShell Provider Hard Drive Password feature
• Dell Command PowerShell Provider Peak Shift feature
• Dell Command PowerShell Provider BIOS Passwords feature