# User for ASM Automated Backup Script

**URL:** <https://community.f5.com/t/user-for-asm-automated-backup-script/13736>\
**Category:** Technical Forums\
**Tags:** big-ip, asm-advanced-waf, bash, backup, security, devops, script\
**Created:** [March 13, 2019, 4:06am UTC](https://community.f5.com/t/user-for-asm-automated-backup-script/13736 "2019-03-13T04:06:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![saidshow\_251381](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@saidshow\_251381](https://community.f5.com/u/saidshow_251381)\
**Post date:** [March 13, 2019, 4:06am UTC](https://community.f5.com/t/user-for-asm-automated-backup-script/13736/1 "2019-03-13T04:06:47Z")

</div>

Hi Guys,

I have a script that allows me to backup ASM policies in moments, the catch however is that this script requires credentials for a user with Advanced Shell Access. Advanced Shell Access requires Administrative privileges. As a result, this script then creates a security issue even when properly stored and access simply due to the hardcoded credentials in the script.

I am aiming to reduce the severity of this issue in one of two ways: - Is it possible to have a user with read only permissions in the portal and advanced shell access on the box? or can I create an API only user? - Alternatively is anyone aware of how I can swap out credentials from my script so that if the script was discovered, credentials would not be identified?

Thanks

---

<div class="post-metadata">

**Author:** ![Kai\_Wilke](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kai_wilke/32/24646_2.png) [@Kai\_Wilke](https://community.f5.com/u/Kai_Wilke)\
**Post date:** [March 15, 2019, 1:49pm UTC](https://community.f5.com/t/user-for-asm-automated-backup-script/13736/2 "2019-03-15T13:49:17Z")

</div>

Hi Saidshow,

interesting question which I don’t have an answer for. But… 😉

… how about placing the script directly on your units and let the script push the backups to a file share. In this case you only need some user credentials to write onto your share.

A backup job could for an example be triggered via an anonymous GET request (or ask for some hardcoded credentials) through an iRule attached to an ordinary HTTP Virtual Server. Once the iRule is executed it would generate a specific log line, which triggers an iCall log-event and finally executes your backup script to generate the backups and store them on the file share…

> **[DevCentral - An F5 Technical Community](https://community.f5.com/)**
>
> DevCentral is an online technical community where engineers and practitioners collaborate, share knowledge, and solve problems related to F5 technologies and industry trends.

Cheers, Kai