This storing on secure OS location is only the first step. The issues to be solved are:
- a regular operational should not run by some personal account, use a dedicated limited service account for that
- Adminitrators on the OS level could see and copy all plain text passwords in your secure location.
Remember: root has all acces without logging

1+ for one thing you are fine with this the approach is a generic clear understandable one without any dependencies
+ close the logging loophole while reviewing code there are manu sas tips to do that

Using SAS code it is rather easy to improve. What you could do:
- Store the real passwords in an encrypted SAS dataset using a password on that dataset.
In reality that password is used for encryption and is not related to real access security.
- use the password stored at the OS for accessing that SAS dataset.
- Have the text read from a record out of that SAS dataset being put in the real source location
No need for intermediate macrovars or whatever as sas functions exist to read one record- column as a macro result.

What is additional achieved:.
The real user / password / token access or whatever is protected by
2+ SAS processing is needed to read that sas dataset. Ordinary OS admins normally don''t know anything about that
3+ For the service account some shared access is allowed by a group of admins. No dependency on a single person,