Active Directory用户密码存储安全优化：加密CSV读写方案咨询

我正在开发一个用于创建Active Directory用户的原型程序，目前将密码存储在CSV文件中，这种方式存在严重的安全风险。由于我的Python脚本依赖该CSV文件，且另有PowerShell脚本负责生成AD用户，因此想咨询：是否可以对CSV文件进行加密，同时保留追加记录、读取内容的功能，以此提升程序安全性？

Python脚本 #

import csv
import subprocess, sys
from password_generator import password_generator

def header():
    headerList = ['Name', 'username', 'passcode', 'Title', ]

    # open CSV file and assign header
    with open("users.csv", 'w', newline='') as file:
        dd = csv.DictWriter(file, delimiter=',',
                            fieldnames=headerList)
        dd.writeheader()

def add_user():
    infile = open("users.csv", "a")
    Name = str((input('enter your full name:')))
    username = str((input('enter your username:')))
    passcode = password_generator()
    Title = str((input('enter your job title:')))

    data1 = f"\n{username},{passcode},{Name},{Title}"
    data = data1.strip()  # strips white space
    infile.write(data + "\n")  # appends to new line
    print('record added succesfully !')
    infile.close()

def gen_user():
    p = subprocess.Popen(["powershell.exe",
                          "C:\\Users\\Administrator\\Desktop\\AD_Users.ps1"],
                         stdout=sys.stdout)
    p.communicate()

def main():
    print('Welcome to AD_USERS creation')
    print('********************************************************'
          ' **  \n'
          ' **  Please choose one of the options below:\n'
          ' **  [a] to add new AD user record\n'
          ' **  [h] to initialze headers\n'
          ' **  [G] to generate users \n'
          ' **  [q] to quit \n'
          ' ********************************************************\n')
    choice = input('pick:')
    while True:
        if choice == "a":
            add_user()
            break
        elif choice == "h":
            header()
            break
        elif choice == "G":
            gen_user()
            break
        elif choice == "q":
            break

        else:
            print('Invalid choice!')

main()  # calls all the code

PowerShell脚本 #

Import-Module ActiveDirectory
$ADUsers = Import-Csv C:\users.csv
foreach ($User in $ADUsers) {
    $Name = $User.Name
    $username = $User.username
    $password = $User.passcode
    $Title=$User.Title
    New-ADUser -Name $Name -SamAccountName $username -AccountPassword (ConvertTo-secureString $password -AsPlainText -Force) -Title $Title
    Enable-AdAccount -Identity $username
}

完全可以实现加密CSV文件并保留追加、读取功能，以下是两种实用方案：

方案1：单条记录加密（推荐） #

采用Fernet对称加密算法，每条用户记录加密后写入文件，既支持追加操作，又能确保敏感数据不泄露。

步骤1：生成并保存加密密钥 #

运行一次以下代码生成密钥，密钥需妥善保管，禁止硬编码到脚本中：

from cryptography.fernet import Fernet

key = Fernet.generate_key()
with open("secret.key", "wb") as key_file:
    key_file.write(key)

步骤2：修改Python脚本实现加密追加 #

调整header和add_user函数，表头明文存储方便识别结构，每条用户记录加密后追加写入：

import csv
import subprocess, sys
from password_generator import password_generator
from cryptography.fernet import Fernet

# 加载加密密钥
def load_key():
    return open("secret.key", "rb").read()

key = load_key()
fernet = Fernet(key)

def header():
    headerList = ['Name', 'username', 'passcode', 'Title', ]
    # 表头明文写入
    with open("encrypted_users.csv", 'w', newline='', encoding='utf-8') as file:
        file.write(",".join(headerList) + "\n")

def add_user():
    Name = input('enter your full name:').strip()
    username = input('enter your username:').strip()
    passcode = password_generator()
    Title = input('enter your job title:').strip()
    # 构造记录并加密
    record = f"{Name},{username},{passcode},{Title}"
    encrypted_record = fernet.encrypt(record.encode()).decode()
    # 追加加密记录
    with open("encrypted_users.csv", "a", encoding='utf-8') as infile:
        infile.write(encrypted_record + "\n")
    print('record added successfully !')

# 其余gen_user和main函数保持不变，注意修改gen_user中调用的PowerShell脚本对应的文件名

步骤3：修改PowerShell脚本实现解密读取 #

更新PowerShell脚本，加载密钥解密每条记录后再创建AD用户：

# 加载Fernet密钥（替换为实际密钥文件路径）
$keyBytes = [System.IO.File]::ReadAllBytes("C:\Users\Administrator\Desktop\secret.key")
$fernetKey = $keyBytes[0..31]
$iv = $keyBytes[32..47]

# 解密函数
function Decrypt-FernetString {
    param([string]$EncryptedString)
    $encryptedBytes = [Convert]::FromBase64String($EncryptedString)
    $aes = New-Object System.Security.Cryptography.AesManaged
    $aes.Key = $fernetKey
    $aes.IV = $iv
    $aes.Mode = [System.Security.Cryptography.CipherMode]::CBC
    $aes.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
    
    $decryptor = $aes.CreateDecryptor()
    $decryptedBytes = $decryptor.TransformFinalBlock($encryptedBytes, 0, $encryptedBytes.Length - 32)
    return [System.Text.Encoding]::Utf8.GetString($decryptedBytes)
}

# 读取加密文件并处理
$fileContent = Get-Content "C:\Users\Administrator\Desktop\encrypted_users.csv"
$header = $fileContent[0]
$encryptedRecords = $fileContent[1..($fileContent.Count-1)]

foreach ($record in $encryptedRecords) {
    $decryptedRecord = Decrypt-FernetString $record
    $userData = $decryptedRecord -split ","
    $Name = $userData[0]
    $username = $userData[1]
    $password = $userData[2]
    $Title = $userData[3]
    
    New-ADUser -Name $Name -SamAccountName $username -AccountPassword (ConvertTo-SecureString $password -AsPlainText -Force) -Title $Title
    Enable-AdAccount -Identity $username
}

方案2：整文件加密（适合小体积文件） #

使用Windows自带的EFS加密文件系统加密整个CSV文件，无需修改代码，但仅适用于Windows系统，且只有加密文件的用户账户可访问。

操作步骤 #

1. 右键点击目标CSV文件，选择「属性」→「高级」
2. 勾选「加密内容以便保护数据」，点击确定保存设置

内容的提问来源于stack exchange，提问作者John Adams