« first day (3160 days earlier)      last day (108 days later) » 

12:08
The script based on Yocto image build for IoT device operating system create with custom modules and components.
It produces a lot of logs, and I am using AWS spot server, for troubleshooting logs and check error, I want to store this file somewhere to help developer to understand Error.
@louigi600 Yes, using an S3 bucket is a better option when dealing with AWS servers. However, the issue is that there is currently no AWS IAM user configured for uploading to S3. Despite that, this option is still better than wasting time trying to find another way.
13:04
@MoriKuldip so, why not just tee all output streams to a file, or use the script command from util-linux package, as mentioned previously, and upload it somewhere?
Hello everyone,

I'm trying to figure out how best to handle secrets in bash. I thought of doing a https call to a hashicorp / azure vault to get a password but then again - running said bash script in guest is that really that more secure?
@Maartenw how secure should it be? RAM is safe for the user of the process only but not safe from user root. Any user who can read /proc/${pid}/environ files could see the environment variables, too. Stracing and shell XTracing is another option to see the data flows. Not to mention cases with rooted processes like Docker service, etc.
I don't think being unsafe from root will be an issue. In essence I'm tryna make a service account with a set password accross multiple vms.
If root is compromised I'm guessing I have bigger issues
The thing with environment files that I perhaps am misunderstanding - if I'm orchestrating the script to run I'm not sure how I'll be able to set those env files fully automated without passing said passwords regardless
13:44
@Maartenw if process environment variables is an option, then what's the issue? Just be aware that these will be copied at exec or fork process if not stated otherwise.
DotEnv is another option if safe storage is available.
Is passing the secrets the issue or storing them?
I'll look into process env. & dotenv. Just passing them - they don't need to be stored
All they're needed for is a usermod <secret>
@Maartenw dotenv.org are files which are being read using conventional (not standard) utilities like dotenv language libraries or github.com/dotenvx/dotenvx (i.e. those normally must be stored at the desired environment file-system).
Ooo
Looks promising - I'll look into it thank you!
If it's something to be more complex, indeed HashiCorp's Vault is an option: vaultproject.io
If it's rather simple, and the environment and project itself is generally safe (e.g. does not pass the credentials to other unknown processes), passing secrets to the process via environment variables is an option, too.
We currently use hashicorp vault but only for onboarded vms - vms onboarded I am already able to pass the secrets no problem
Just experiencing trouble with non onboarded vms - currently the middle road is just run the bash script with password prompt
13:56
E.g. APP_USERNAME='user1' /use/bin/php /opt/script.php;
If it must be more safe: /usr/bin/env -i -- APP_USERNAME='user' /bin/php './opt/script.php';
 
2 hours later…
15:42
well depends what you mean by secure
bash is not really meant to handle security
you can try to obfuscate your scripts or try to make them darn side hard to read, but whatever you do it is not going to be impossible to read if it needs to left in an executable format
what you can do is use for example openssl to do some ciphering and have the script ask you for the key interactively
anything that is not interactive to decipher will be possible to hack
and even at that be carefull who is poking around whn you iteract with the script

« first day (3160 days earlier)      last day (108 days later) »