Re:Best practices for managing and storing secrets like API ...
by kohtatsu on Friday June 12, 2020 @04:22PM
(#23503476)
https://github.com/plyint/encpass.sh/blob/93d42340/encpass.s...
It uses PBKDF2 with 10,000 iterations if anyone else was wondering.
The code is clean, kudos.
Re:Best practices for managing and storing secrets like API ...
by Mandatum on Sunday June 14, 2020 @11:52PM
(#23523617)
Is there an easy way to tell the version of an encpass.sh if all you have is the script?
Say I was checking my encpass.sh files on a bunch of different nodes and wanted to make sure they were all based on the current master version - would I have to sha256 them and compare?
Re:Best practices for managing and storing secrets like API ...
by ahnick on Tuesday June 16, 2020 @05:38PM
(#23544546)
Yes, just compute the sha256 checksums and compare. I had been meaning to add a version command to encpass.sh for a while now and just hadn't made time for it. Your comment was the impetus I needed, so I've gone ahead and added support for computing the sha256 checksums of encpass.sh and any extension and also displaying the tag version.
I've cut a new release for the version command, v4.1.0. See the release notes here for additional details -> https://github.com/plyint/encpass.sh/releases/tag/v4.1.0
Sometimes when you are hacking on a shell script or you have some configuration management pieces you just need a simple way to store and access secrets locally without having to invest in a lot of infrastructure. (Especially if you are working for an employer where you don't even get to have a say in the infra)
At Plyint(https://plyint.com), we actually use it to manage team level secrets through Keybase. To make this easier we wrote an extension encpass-keybase.sh(https://github.com/plyint/encpass.sh/blob/master/extensions/...), which uses Keybase's keys, encryption, and git repos.