How to handle secrets on the command line
smallstep.com
How to handle secrets on the command line
1–10 of 77 posts
Re: How to handle secrets on the command line
#2> Some operating systems still make every process’s environment variables world readable. (But, in all the Linuxes I’ve seen, /proc//environ is not world-readable.)
A couple years ago this came up and someone made this claim, but no one could ever name an OS where this is the case. Maybe someone on HN knows one? :)
Re: How to handle secrets on the command line
#3I've been using a combination of the Keyring[0] CLI utility, Direnv and environment variables to load secrets for specific projects from the macOS keychain into the environment. The advantage of Keyring over macOS own security tool is that it is cross-platform and your setup scripts will work fine for Linux users as well.
Re: How to handle secrets on the command line
#4You have envchain to store secrets as ENV variables in your keyring and execute commands:
https://github.com/sorah/envchain
Not really something you would use for production web apps, I think envconsul covers that usecase:
Re: How to handle secrets on the command line
#5> Some operating systems still make every process’s environment variables world readable. (But, in all the Linuxes I’ve seen, /proc/ /environ is not world-readable.) A couple years ago this came up and someone made this claim, but no one could ever name an OS where this is the case. Maybe someone on HN knows one? :)
[deleted]
Re: How to handle secrets on the command line
#6I wrote a simple oh-my-zsh (but should be easy to port out) plugin to improve UX of the environment variables option [0]. It's basically a very simple secrets manager, allowing one to store env variables (or whole chunks of scripts) in GPG-encrypted files and see if any secrets are sourced at the moment.
So the workflow usually looks like following:
$ secrets aws-credentials # prompts a GPG passphrase
$ aws s3 sync ...
Re: How to handle secrets on the command line
#7> Some operating systems still make every process’s environment variables world readable. (But, in all the Linuxes I’ve seen, /proc/ /environ is not world-readable.) A couple years ago this came up and someone made this claim, but no one could ever name an OS where this is the case. Maybe someone on HN knows one? :)
AIX 5.2? That was EOL 2008, it seems hardly worth warning about these days.
https://github.com/mobile-shell/mosh/issues/156#issue-407789...
Re: How to handle secrets on the command line
#8I wrote a simple oh-my-zsh (but should be easy to port out) plugin to improve UX of the environment variables option [0]. It's basically a very simple secrets manager, allowing one to store env variables (or whole chunks of scripts) in GPG-encrypted files and see if any secrets are sourced at the moment. So the workflow usually looks like following: $ secrets aws-credentials # prompts a GPG passphrase $ aws s3 sync .…
If you use `pass` I wrote a little plugin to export the values as environmental variables in a simple and consistent fashion:
Re: How to handle secrets on the command line
#9Sidenote: I really like the cookie consent form on this site. It's unobtrusive, clear, opt-out by default and the highlighted and only button is "Continue to site". And it even has a built-in GDPR request form! Bravo to https://www.clym.io/
Nice article, covers the basics well. Credential files seem like simplest way to go and are secure enough for most local uses. For anything more involved a secrets manager is probably required. I've been using Linux for a long time and hadn't heard about `keyctl`, thanks for mentioning it. A more flexible solution might be https://github.com/mozilla/sops
Re: How to handle secrets on the command line
#10Sidenote: I really like the cookie consent form on this site. It's unobtrusive, clear, opt-out by default and the highlighted and only button is "Continue to site". And it even has a built-in GDPR request form! Bravo to https://www.clym.io/ Nice article, covers the basics well. Credential files seem like simplest way to go and are secure enough for most local uses. For anything more involved a secrets manager is prob…
It makes me feel weird that I have the option to “fill a form to not sell my personal data” though.