4 ms·

Or don't have the keys on the server at all. Anyone who gets root access can walk right up to the key file and yoink it. Obviously keys have to be stored some

Or don't have the keys on the server at all. Anyone who gets root access can walk right up to the key file and yoink it. Obviously keys have to be stored somewhere. But it doesn't have to be on every server's disk. Also, try to avoid passing in keys as command line arguments. If you can, avoid using environment variables, too. You can pass thet data in using standard in, so the data is never exposed. Example of leaky environment variables: https://gist.github.com/amorphid/db037f03246962959b6a034b2ca3ef1b https://gist.github.com/amorphid/db037f03246962959b6a034b2ca...

grey-area 10y ago
Interesting link on env vars. Any links on how to do this properly?
- duaneb 10y ago
  You can just overwrite the WBC variables once you read them in process. TBH, though, if they are sniffing env variables from processes there's not reason not to sniff that process's memory directly.
- amorphid 10y ago
  Here's an example you can try on any Linux System running procfs. https://gist.github.com/amorphid/4a65741d14db38b96341d7e1f2dd69b6 https://gist.github.com/amorphid/4a65741d14db38b96341d7e1f2d... The short version is I'm passing a variable in via the pid's standard in, reading the line, and then declaring the variable. This is a very contrived example :) But you can write a wrapper script that would handle all of the line reading for you. This originally came up when I was asking someone how to pass sensitive information (API keys, passwords, etc.). I did some research, and found this approach. In most programming languages, for basic system calls, you basically just call a command, that command runs, and then exits. But sometimes you want a script that can take information from standard in, or send it to you from standard out. Like you may write a script that runs for a few minutes, then says "OK, I'm ready for the password!", and then you pass it in at the time it's needed (but honestly, don't do it unless you need to, because it's one more thing that can break. Erlang/Elixir land have a library called erlexec that does this => http://saleyn.github.io/erlexec/ http://saleyn.github.io/erlexec/ Another Elixir library is Porcelain => https://github.com/alco/porcelain https://github.com/alco/porcelain
daxelrod 10y ago
Those env vars should only be exposed to the same user. The same user can also usually attach a debugger and read the secrets from memory. (Of course, this is harder, so you may not want secrets in env vars anyway.) The unix permissions model is designed to isolate one user's data from another.
deleted 10y ago
[deleted]

grey-area 10y ago

Interesting link on env vars. Any links on how to do this properly?

duaneb 10y ago
You can just overwrite the WBC variables once you read them in process. TBH, though, if they are sniffing env variables from processes there's not reason not to sniff that process's memory directly.
amorphid 10y ago
Here's an example you can try on any Linux System running procfs. https://gist.github.com/amorphid/4a65741d14db38b96341d7e1f2dd69b6 https://gist.github.com/amorphid/4a65741d14db38b96341d7e1f2d... The short version is I'm passing a variable in via the pid's standard in, reading the line, and then declaring the variable. This is a very contrived example :) But you can write a wrapper script that would handle all of the line reading for you. This originally came up when I was asking someone how to pass sensitive information (API keys, passwords, etc.). I did some research, and found this approach. In most programming languages, for basic system calls, you basically just call a command, that command runs, and then exits. But sometimes you want a script that can take information from standard in, or send it to you from standard out. Like you may write a script that runs for a few minutes, then says "OK, I'm ready for the password!", and then you pass it in at the time it's needed (but honestly, don't do it unless you need to, because it's one more thing that can break. Erlang/Elixir land have a library called erlexec that does this => http://saleyn.github.io/erlexec/ http://saleyn.github.io/erlexec/ Another Elixir library is Porcelain => https://github.com/alco/porcelain https://github.com/alco/porcelain

daxelrod 10y ago

Those env vars should only be exposed to the same user. The same user can also usually attach a debugger and read the secrets from memory. (Of course, this is harder, so you may not want secrets in env vars anyway.) The unix permissions model is designed to isolate one user's data from another.

deleted 10y ago

[deleted]