Jakob Holderbaum - Managing Shared secrets using basic Unix tools
0 likes370 views
The document discusses managing shared secrets for applications using basic Unix tools like GPG and the pass password manager. It describes storing secrets in an encrypted password store that multiple developers can access. Secrets like API tokens are added to the store and environment variables are used to access them when running applications without embedding secrets directly in code. The process for initializing a shared password store and adding/removing developer access is also covered.
Jakob Holderbaum - Managing Shared secrets using basic Unix tools
- 1. Join the conversation #devseccon By Jakob Holderbaum / @hldrbm Managing Shared Secrets using Basic Unix Tools
- 2. What are shared Secrets?
- 3. var PASSWORD = 'sn4k3oil'
- 4. var PASSWORD = yaml .load(fs.readFileSync('secrets.yml')) .password
- 5. var PASSWORD = process.env.PASSWORD
- 6. syncable secure flexible constant in code ++ − − config file − + + environment − + ++
- 7. GPG
- 9. pass
- 10. pass “the standard unix password manager”
- 11. brew install pass sudo apt-get install pass sudo pacman -S pass ...
- 13. var express = require('express') var app = express() var user = process.env.GITHUB_USER var apiToken = process.env.GITHUB_API_TOKEN var port = process.env.PORT || 5000 app.get('/', function (req, res) { // Implement GitHub API call }) app.listen(port, function () { console.log('App listening on port ' + port) })
- 14. var express = require('express') var app = express() var user = process.env.GITHUB_USER var apiToken = process.env.GITHUB_API_TOKEN var port = process.env.PORT || 5000 app.get('/', function (req, res) { // Implement GitHub API call }) app.listen(port, function () { console.log('App listening on port ' + port) })
- 15. $ git push heroku master:master
- 16. $ heroku config:set GITHUB_USER="holderbaum" GITHUB_API_TOKEN="sn4k3oil"
- 17. Let’s build a secret store!
- 18. $ export PASSWORD_STORE_DIR=~/code/app/secrets $ export MY_ID=5244D411CD7CBA95 $ pass init $MY_ID
- 19. $ export PASSWORD_STORE_DIR=~/code/app/secrets $ export MY_ID=5244D411CD7CBA95 $ pass init $MY_ID
- 20. $ export PASSWORD_STORE_DIR=~/code/app/secrets $ export MY_ID=5244D411CD7CBA95 $ pass init $MY_ID
- 21. $ export PASSWORD_STORE_DIR=~/code/app/secrets $ pass add production/user $ pass add production/api_token
- 22. $ export PASSWORD_STORE_DIR=~/code/app/secrets $ pass show production/api_token "sn4k3oil"
- 24. $ find ~/code/app/secrets ~/code/app/secrets/.gpg_id ~/code/app/secrets/production/user.gpg ~/code/app/secrets/production/api_token.gpg $ cat ~/code/app/secrets/.gpg_id 5244D411CD7CBA95
- 25. $ export PASSWORD_STORE_DIR=~/code/app/secrets $ pass ls +-- production |-- api_token +-- user
- 26. $ export PASSWORD_STORE_DIR=~/code/app/secrets $ export USER=`pass show production/user` $ export TOKEN=`pass show production/api_token` $ heroku config:set GITHUB_USER=$USER GITHUB_API_TOKEN=$TOKEN
- 27. $ export PASSWORD_STORE_DIR=~/code/app/secrets $ export USER=`pass show production/user` $ export TOKEN=`pass show production/api_token` $ heroku config:set GITHUB_USER=$USER GITHUB_API_TOKEN=$TOKEN
- 28. Working with a Team
- 29. Roll On
- 30. $ export PASSWORD_STORE_DIR=~/code/app/secrets $ export MY_ID=5244D411CD7CBA95 $ export ADAS_ID=44A7B1E354AF81E2 $ export ALANS_ID=BA29EE533AF39B21 $ pass init $MY_ID $ADAS_ID $ALANS_ID
- 31. $ export PASSWORD_STORE_DIR=~/code/app/secrets $ export MY_ID=5244D411CD7CBA95 $ export ADAS_ID=44A7B1E354AF81E2 $ export ALANS_ID=BA29EE533AF39B21 $ pass init $MY_ID $ADAS_ID $ALANS_ID
- 34. Roll Off
- 35. $ export PASSWORD_STORE_DIR=~/code/app/secrets $ export MY_ID=5244D411CD7CBA95 $ export ADAS_ID=44A7B1E354AF81E2 $ pass init $MY_ID $ADAS_ID
- 36. $ export PASSWORD_STORE_DIR=~/code/app/secrets $ export MY_ID=5244D411CD7CBA95 $ export ADAS_ID=44A7B1E354AF81E2 $ pass init $MY_ID $ADAS_ID
- 39. What have we achieved?
- 40. Join the conversation #devseccon Find an online version of this talk: https://jakob.io/devseccon16