6 ms·
Environment variables are the best and easiest way that I know of. You can supply those anyway you want to, and any programming language can easily get their va
by tokenizerrr 11y ago
Environment variables are the best and easiest way that I know of. You can supply those anyway you want to, and any programming language can easily get their values.
- alexisnorman 11y agoI'm surprised this isn't higher up. Are there any arguments against ENV variables in favor of something else?
- marcus 11y agoENV variables are inherited by child processes by default, so please use care when using this approach.
- smtddr 11y agoHere's my caution to this. If low level processes can do "ps aux", and they see something like: DB_USER=scott DB_PASSWORD=b3withm3pl3aze /usr/bin/python webapp.py That could be troublesome if an attacker figured out a way to run remote commands on your server even as an unprivileged user.
- yrro 11y agoReading the environment of another process is a privileged operation.
- vidarh 11y agoThe example above is someone who have stupidly started a process with the environment variables exposed on the command line
- yrro 11y agoOk, but that's not a problem caused by the exposure of the environment, it's caused by the exposure of the command line.
- vidarh 11y agoI agree - I was just explaining what the issue the above commenter raised. It just means you should use a saner way of initializing your environment with sensitive values.
- smtddr 11y agoIf an attacker can get the process that's running the webapp.py to exec some abitrary bash command, that process has the ability to read its own /proc/$PID/environ . In general, you can read /proc/$PID/environ on processes that you own. At least I can do that on my Debian system: pikachu@POKEMONGYM ~ $ sleep 99 & [1] 21340 pikachu@POKEMONGYM ~ $ cat /proc/21340/environ XDG_SESSION_ID=5COMP_WORDBREAKS= "'><;|&(:TERM=screenSHELL=/bin/bashXDG_SESSION_COOKIE=8571b679eed8952dd96ad28a54...<etc> (I actually gave the wrong example in my previous comment. While it is true that giving the ENV on cmdline will show up in ps eaux, the more appropriate example is what I just explained in this comment.)
- tokenizerrr 11y agoIf you can get it to exec some arbitrary bash command (or otherwise access the environ of a process) you can also have it cat any file on the server, and even the memory of the running processes that belong to the same user as the exploited process, and also execute network requests. So if you get that far, pretty much nothing will protect you.
- smtddr 11y agoSure, but there are some shops that do their security from a point-of-view of "Attacker can run commands on your server as the user that started whatever-public-service/webapp/api", and go from there. I happen to think that's the best way to think about it. Now, if an attacker manages to get root access then it's game over[1]. That just shouldn't happen. But nobody should be running their webserver as root. So, whatever that user is should be low-powered with only enough privileges to start the webserver & bind port 8080 (and use iptables or whatever to reroute connections to port 80 --> 8080) and the whole setup should be designed that this account won't be able to escalate things further if someone got a bash shell to it. ______ 1. You should at least have some way of detecting that it happened and consider all data & files compromised and just wipe the whole machine & start over. Or take that machine offline for investigation into what happened and put a fresh new one in its place.
- 11y ago
- Dylan16807 11y agoWhen I test that, the command line does not include the variable-setting. Is this a problem that depends on version or are you mistaken? It would be kind of weird to include that considering how argv works.
- jsjohnst 11y agoGlad I don't work at your shop then. Environment variables are a terrible way to give your app secure information. There's well over a dozen reasons why you shouldn't do this in your apps, but one super obvious one is there's way to many frameworks that expose environment variables in their debug output if not properly configured. Think you'll never misconfigure a server? Guess again, pretty much every major site (Google, FB, Twitter, Yahoo, EBay, Microsoft, etc) have all done it at some point.
- tokenizerrr 11y agoPlease review HN's guidelines on civility.
- shutupbitch 11y agoNothing uncivil about his/her response, you just need thicker skin.
- tokenizerrr 11y agoI'm glad you made a new account named 'shutupbitch' just to tell me this. Thank you for your contribution.
- dang 11y agoPlease don't feed trolls.
- jsjohnst 11y agoFair point, I potentially should've left off the first sentence. I stand behind the rest of the post, but the first sentence is a bit on the edge and I apologize.
- tokenizerrr 11y agoAlright, well, I've never seen an application/framework spit out environment variables when it was misconfigured. But then again, I barely work with web-related stuff so maybe I just don't use the kind of software that does this. Could you provide some examples?