Where to store security credentials (aka passwords) for special cron jobs?

Question

I want to write a cron job that authenticates for a certain mail account. As there are multiple ways in giving the script those credentails: config file, hardcoded in script, arguments in cronjob call,.. Where do I put those credentials?

(Currently I would favor as giving them the script via arguments as the script is then independent. But is that secure?)

Thanks for your thoughts.

Answer 1

Put the credentials into a file that has restricted read access.

Unless your cron tables already have similarly restricted read access. As grawity noted, putting the credentials into the crontab can result in them leaking to logs and/or email. Thus, it should be strongly discouraged and they should be properly protected inside a file.