In reply to Kevin Donahue.

Kevin, thank you for your comment. I agree that storing passwords in Metadata is a preferred way. However, not all SAS installations have metadata. In many cases, SAS code is run interactively or in batch mode without touching metadata. And unfortunately, I have seen way too many cases when SAS programmers carelessly place unencrypted passwords into their code.

For the SAS BI installations, I wrote in this blog post: "There are other methods of obscuring passwords to protect access to sensitive information that are available in the SAS Business Intelligence Platform. These are the AUTHDOMAIN= SAS/ACCESS option supported in LIBNAME statements, as well as PROC SQL CONNECT statements, SAS Token Authentication, and Integrated Windows Authentication. For more details, see Five strategies to eliminate passwords from your SAS programs."

For the Unix shell scenario you are doing it exactly right: you encode the passwords and protect the files where the passwords are stored. Here is another example of storing an encoded password in an external file.