You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Oct 23, 2019. It is now read-only.
Most of the passwords defined in oisp-config.yaml are not critical, since the components can only be reached internally through services, and we are trusting OISP components by design. However, the system user password is critical, since external requests can be made to the frontend with this user.
This password is currently hard-coded in values.yaml, which is published on the repo. We are relying on the administrator to manually change this. It is very likely that human error will occur at this point.
We can randomly auto-generate this on deployment, but this approach has its problems:
This value can not be regenerated on every update, as the user is already saved in the database.
If the value is stored locally, one can not deploy from multiple sources, and the value can leak easily.
The proper way of implementing this is using Kubernetes secrets, which is not completely completable with our current config system, as secrets are passed on as files or environment variables. Our current system expects the passwords to be embedded in JSON ENV variables. We need to refactor frontend and rule engine to read the password from a standalone environment variable to be able to implement this as a secret.
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
They should also be taken out of config and inserted in secrets.
The text was updated successfully, but these errors were encountered: