Environment Variables Considered Harmful for Your Secrets

Re:Environment Variables Considered Harmful for Your Secrets by tezza on Friday January 02, 2015 @07:50AM (#8826574)

  Cloud servers
  =============

Xen supports virtual TPM.

I'm no Amazon EC2 expert, but a quick google exposed a few keen souls who tried to use vTPM and failed. This would suggest that Amazon does not yet support vTPM.

  Re-entering passphrases
  ========================

Well, unless the machine is permissioned by default you will need to give a fresh instance new authorization. Permissioning by default is the same security problem you're trying to avoid though... just shifted. Your overall goal is to have the credentials inaccessible to sniffing, right ?

I guess you could set up some form of ssh-agent handshake to make the process less manual.

[ Parent | on HN ]

Re:Environment Variables Considered Harmful for Your Secrets by druiid on Friday January 02, 2015 @11:35AM (#8827351)

XenServer (The product from Citrix) or Xen 4.3+ support vTPM. Not sure which version of Xen that Amazon uses, but if/when they upgrade to 4.3 it should have built-in support for vTPM operations.

[ Parent | on HN ]

Re:Environment Variables Considered Harmful for Your Secrets by mreinsch on Friday January 02, 2015 @08:00AM (#8826595)

sniffing isn't the main issue I'm trying to avoid, it's accidental exposure. I.e. minimising the risk that during normal operations the secrets get exposed somehow.

[ Parent | on HN ]

Re:Environment Variables Considered Harmful for Your Secrets by tezza on Friday January 02, 2015 @08:44AM (#8826697)

Okay... sniffed accidentally then ( putting them in the wrong directory, not using fs permissions properly etc )

I would say that you should consider malicious sniffing too

[ Parent | on HN ]