One way to avoid having the password documented in the config file, is to provide the user of the script the option of setting it in their shell's ENV instead. This would be temporary and only visible within the current shell running the script. If they have different passwords for each device, it would be cumbersome (it could be done though). Here's an (untested) example:

my $pass;

if (defined $ENV{PASS}){
    $pass = $ENV{PASS};
}
elsif (defined $ini->{$host}{pass}){
    $pass = $ini->{$host}{pass};
}
elsif (defined $ini->{_}{pass}) {
    $pass = $ini->{_}{pass}
}
else {
    die "no password could be found";
}
[download]