Re:Crypto Tools for DevOps: Git-Crypt – Tozny
by emmelaich on Tuesday April 11, 2017 @04:31AM
(#14085851)
Suggesting environment variables or stdin is avoiding the issue to me.
For it to get into the environment or stdin it has to be stored somewhere.
Where is that somewhere and how do you access it?
Ideally the secrets, and the keys to access them would never be accessible directly by the person who initiated the deployment; they'd be fetched directly from where they're stored to where they're deployed.
git-crypt can be a part of this.
More likely you'd something purpose built like many of the solutions mentioned in this discussion.
If you want something commercial then you might consider https://thycotic.com/ Secret Server.
If not then there is a open source Python based server which uses Shamir's Secret Sharing Scheme. (But apologies I've lost the url)
For it to get into the environment or stdin it has to be stored somewhere.
Where is that somewhere and how do you access it?
Ideally the secrets, and the keys to access them would never be accessible directly by the person who initiated the deployment; they'd be fetched directly from where they're stored to where they're deployed.
git-crypt can be a part of this.
More likely you'd something purpose built like many of the solutions mentioned in this discussion. If you want something commercial then you might consider https://thycotic.com/ Secret Server.
If not then there is a open source Python based server which uses Shamir's Secret Sharing Scheme. (But apologies I've lost the url)