231–240 of 246 posts
Earlier quoted context omitted.
With root access I suppose you could have created a restricted account yourself!
I laughed so much at this
Earlier quoted context omitted.
I can't seem to understand how a "secrets manager" helps things. Could someone who does ELI5 why it's better than a config file with permissions locked down?
The real difference over a file is that you some intelligence(the manager) running that can offer all kinds of additional security functionality. A typical deployment might involve placing the manager on a secure host that has access to generate and rotate keys, for example. The manager can then configured to re-generate keys and vend them on-demand to instances that need require them. You can configure these keys wi…
Earlier quoted context omitted.
An elliptic curve key (NaCl etc) is 32 bytes. Here's two such keys for you, as a demo: $ entropy 32|zbase32-encode pu3zrux6t6cqrmmyesdxtppxiudxjcndrx3bomjuyaupa61493no $ entropy 32|phrase-encode afar-pimple-unwind-imagine-buckets-today-duke-sober-dehydrate-rebel-online-nudged-bamboo-saxophone-eluded-tattoo-pause-bays-ungainly-tasked-jingle-topic-null-enraged
While you're right, I'd recommend against both for the specific use-case. You just added another layer. The extra software needs to be available, maybe it's not developed anymore and won't compile on your system, maybe they changed the alphabet from which the words are generated, ... OpenSSH private keys are armoured by default, gpg-keys can be exported and imported in an armored format - and everything else can be j…
fd3223ec 20f55ae7 6fddc979 d41e2276 25255516 b08f5cd4 3d66d676 a054d2bb
Earlier quoted context omitted.
So then how do you manage the secret that authenticates an application's identity? And what good is the logging if after an application has the secret it can do whatever it wants with it?
if it is an instance on the cloud, GCP and AWS let you define ServiceAccounts that get populated on the Instance at boot time. you should only let the instance access the secret it requires.
As OP wrote, you did not solve it, just moved it to a different level.
Earlier quoted context omitted.
> an offline backup printed have you ever tried typing a private key from a piece of paper? once i was in a similar situation and gave up and just drove to the colo.
An elliptic curve key (NaCl etc) is 32 bytes. Here's two such keys for you, as a demo: $ entropy 32|zbase32-encode pu3zrux6t6cqrmmyesdxtppxiudxjcndrx3bomjuyaupa61493no $ entropy 32|phrase-encode afar-pimple-unwind-imagine-buckets-today-duke-sober-dehydrate-rebel-online-nudged-bamboo-saxophone-eluded-tattoo-pause-bays-ungainly-tasked-jingle-topic-null-enraged
Not sure the "right" way to do it. But this is what we did: For context: We run a centralised salt-master, salt master unencrypts content using gpg filters as part of variable generation (salt "pillars"). So it's encrypted at rest and encrypted in our git repositories. What we do/did, is: * grab a pair of differently branded USB sticks. * LUKS encrypt the USB sticks; we used a keyfile which is encrypted on our machin…
Not sure the "right" way to do it. But this is what we did: For context: We run a centralised salt-master, salt master unencrypts content using gpg filters as part of variable generation (salt "pillars"). So it's encrypted at rest and encrypted in our git repositories. What we do/did, is: * grab a pair of differently branded USB sticks. * LUKS encrypt the USB sticks; we used a keyfile which is encrypted on our machin…