Skip to content
This repository has been archived by the owner on Oct 23, 2019. It is now read-only.

Autogenerate secrets and passwords during deployment #6

Open
arkocal opened this issue Feb 6, 2019 · 1 comment
Open

Autogenerate secrets and passwords during deployment #6

arkocal opened this issue Feb 6, 2019 · 1 comment
Labels
feature help wanted Extra attention is needed security

Comments

@arkocal
Copy link
Member

arkocal commented Feb 6, 2019

They should also be taken out of config and inserted in secrets.

@arkocal arkocal added the help wanted Extra attention is needed label Aug 29, 2019
@arkocal
Copy link
Member Author

arkocal commented Aug 29, 2019

@wagmarcel , @oguzcankirmemis Please review this:

Most of the passwords defined in oisp-config.yaml are not critical, since the components can only be reached internally through services, and we are trusting OISP components by design. However, the system user password is critical, since external requests can be made to the frontend with this user.

This password is currently hard-coded in values.yaml, which is published on the repo. We are relying on the administrator to manually change this. It is very likely that human error will occur at this point.

We can randomly auto-generate this on deployment, but this approach has its problems:

  • This value can not be regenerated on every update, as the user is already saved in the database.
  • If the value is stored locally, one can not deploy from multiple sources, and the value can leak easily.

The proper way of implementing this is using Kubernetes secrets, which is not completely completable with our current config system, as secrets are passed on as files or environment variables. Our current system expects the passwords to be embedded in JSON ENV variables. We need to refactor frontend and rule engine to read the password from a standalone environment variable to be able to implement this as a secret.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
feature help wanted Extra attention is needed security
Projects
None yet
Development

No branches or pull requests

1 participant