在Python中的类变量中存储密码
我正在编写一个仅在当前会话期间存储 ssh 密码的 python 脚本。我正在做的是声明一个类变量credentials = {}。当脚本需要访问特定服务器时，它会检查凭据以查看凭据['server']是否存在。如果是，则使用该密码，如果不是，则提示用户。
这一切都工作正常，但我只是想知道这是否是一个不好的实现方法？这并没有在任何关键的地方运行，我需要担心安全性。我只是想如果我能将凭证声明为私有就好了。
这是一个合理的做法吗？有没有一种更Pythonic的方法来做到这一点，或者更适合Python如何处理类成员访问？
I'm working on a python script that stores ssh passwords only during the current session. What I'm doing is declaring a class variable credentials = {}. When the script needs access to a specific server, it checks in credentials to see if credentials['server'] exists. If it does, it uses the password there, if it doesn't, it prompts the user.
This is all working fine, but I'm just wondering if that's a bad way of implementing this? This isn't running anywhere critical that I need to be THAT concerned about security. I was just thinking it'd be nice if I could declare credentials as private.
Is this a reasonable approach? Is there a more pythonic way to do this or one that's better suited for how python deals with class member access?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
有点离题，但是当我过去构建脚本执行此操作时，出于安全考虑，建议使用 ssh-agent 方法。该代理是一个后台进程，独立于 python，但在同一用户下运行，它将存储凭据。那么脚本根本不需要担心提示或处理密码。
A bit of a digression, but when I've built scripts do this in the past, the security minded recommended using an ssh-agent approach. The agent is a background processes, independent of the python but running under the same user, that will store the credentials. Then the script doesn't need to worry about prompting or handling passwords at all.