├── EncryptedStrings_Bash.sh ├── EncryptedStrings_Python.py ├── LICENSE.txt └── README.md /EncryptedStrings_Bash.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # Use 'openssl' to create an encrypted Base64 string for script parameters 3 | # Additional layer of security when passing account credentials from the JSS to a client 4 | 5 | # Use GenerateEncryptedString() locally - DO NOT include in the script! 6 | # The 'Encrypted String' will become a parameter for the script in the JSS 7 | # The unique 'Salt' and 'Passphrase' values will be present in your script 8 | function GenerateEncryptedString() { 9 | # Usage ~$ GenerateEncryptedString "String" 10 | local STRING="${1}" 11 | local SALT=$(openssl rand -hex 8) 12 | local K=$(openssl rand -hex 12) 13 | local ENCRYPTED=$(echo "${STRING}" | openssl enc -aes256 -md md5 -a -A -S "${SALT}" -k "${K}") 14 | echo "Encrypted String: ${ENCRYPTED}" 15 | echo "Salt: ${SALT} | Passphrase: ${K}" 16 | } 17 | 18 | # Include DecryptString() with your script to decrypt the password sent by the JSS 19 | # The 'Salt' and 'Passphrase' values would be present in the script 20 | function DecryptString() { 21 | # Usage: ~$ DecryptString "Encrypted String" "Salt" "Passphrase" 22 | echo "${1}" | /usr/bin/openssl enc -aes256 -md md5 -d -a -A -S "${2}" -k "${3}" 23 | } 24 | 25 | # Alternative format for DecryptString function 26 | function DecryptString() { 27 | # Usage: ~$ DecryptString "Encrypted String" 28 | local SALT="" 29 | local K="" 30 | echo "${1}" | /usr/bin/openssl enc -aes256 -md md5 -d -a -A -S "$SALT" -k "$K" 31 | } -------------------------------------------------------------------------------- /EncryptedStrings_Python.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python2.7 2 | # Python wrapper for 'openssl' to create an encrypted Base64 string for script parameters 3 | # Additional layer of security when passing account credentials from the JSS to a client 4 | import subprocess 5 | 6 | # Use GenerateEncryptedString() locally - DO NOT include in the script! 7 | # The 'Encrypted String' will become a parameter for the script in the JSS 8 | # The unique 'Salt' and 'Passphrase' values will be present in your script 9 | def GenerateEncryptedString(inputString): 10 | '''Usage >>> GenerateEncryptedString("String")''' 11 | salt = subprocess.check_output(['/usr/bin/openssl', 'rand', '-hex', '8']).rstrip() 12 | passphrase = subprocess.check_output(['/usr/bin/openssl', 'rand', '-hex', '12']).rstrip() 13 | p = subprocess.Popen(['/usr/bin/openssl', 'enc', '-aes256', '-md', 'md5', '-a', '-A', '-S', salt, '-k', passphrase], stdin = subprocess.PIPE, stdout = subprocess.PIPE) 14 | encrypted = p.communicate(inputString)[0] 15 | print("Encrypted String: %s" % encrypted) 16 | print("Salt: %s | Passphrase: %s" % (salt, passphrase)) 17 | 18 | # Include DecryptString() with your script to decrypt the password sent by the JSS 19 | # The 'Salt' and 'Passphrase' values would be present in the script 20 | def DecryptString(inputString, salt, passphrase): 21 | '''Usage: >>> DecryptString("Encrypted String", "Salt", "Passphrase")''' 22 | p = subprocess.Popen(['/usr/bin/openssl', 'enc', '-aes256', '-md', 'md5', '-d', '-a', '-A', '-S', salt, '-k', passphrase], stdin = subprocess.PIPE, stdout = subprocess.PIPE) 23 | return p.communicate(inputString)[0] 24 | 25 | # Alternative format for DecryptString function 26 | def DecryptString(inputString): 27 | '''Usage: >>> DecryptString("Encrypted String")''' 28 | salt = "" 29 | passphrase = "" 30 | p = subprocess.Popen(['/usr/bin/openssl', 'enc', '-aes256', '-md', 'md5', '-d', '-a', '-A', '-S', salt, '-k', passphrase], stdin = subprocess.PIPE, stdout = subprocess.PIPE) 31 | return p.communicate(inputString)[0] -------------------------------------------------------------------------------- /LICENSE.txt: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) 2015 Bryson Tyrrell 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in 13 | all copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | THE SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | Encrypted Strings 2 | ================== 3 | Credit to Jason Van Zanten for the original code this is based upon 4 | 5 | The Bash and Python scripts included here contain functions that use 'openssl' to generate encrypted strings with unqiue hashes and passphrases required for decoding and the functions to use those values to decrypt the strings. 6 | 7 | The most obvious use case is passing credentials from a JSS policy to a script running on the client. This is usually done when some action using an API (either the JSS API or another API) is required. The password for this service account can be encrypted using these functions to better protect it. 8 | 9 | The encrypted string would be entered as a policy parameter. The unique 'salt' and 'passphrase' values would be present in the script downloaded to the client. This requires any party to have access to the script code as well as the policy in the JSS in order to decrypt the string. 10 | 11 | Here are examples of these functions in both languages: 12 | 13 | ```bash 14 | ~$ GenerateEncryptedString "Captain Hammer" 15 | Encrypted String: U2FsdGVkX18/iRQ6O7Hr+pouW8TAl0RcrUByBUzavuY= 16 | Salt: 3f89143a3bb1ebfa | Passphrase: 67a61589eb6fb3874052333b 17 | 18 | ~$ DecryptString U2FsdGVkX18/iRQ6O7Hr+pouW8TAl0RcrUByBUzavuY= 3f89143a3bb1ebfa 67a61589eb6fb3874052333b 19 | Captain Hammer 20 | ``` 21 | 22 | ```python 23 | >>> import subprocess 24 | 25 | >>> GenerateEncryptedString("Doctor Horrible") 26 | Encrypted String: U2FsdGVkX1/+1bcze4/E7R3wCfEru9qnHWG5da7p+bg= 27 | Salt: fed5b7337b8fc4ed | Passphrase: bbf59ee05d84e8c8d5190b31 28 | 29 | >>> DecryptString('U2FsdGVkX1/+1bcze4/E7R3wCfEru9qnHWG5da7p+bg=', 'fed5b7337b8fc4ed', 'bbf59ee05d84e8c8d5190b31') 30 | 'Doctor Horrible' 31 | ``` 32 | --------------------------------------------------------------------------------