PASSWORD/KEY distinction+match for secret generation #33

2020-11-01T20:13:48Z

decentral1se commented

2020-11-01 20:13:48 +00:00

Working on https://git.autonomic.zone/coop-cloud/abra/issues/32#issuecomment-1828.

Rules are:

SECRET.*PASSW.*D.*VERSION: "password", generated using pwqgen
SECRET.*KEY.*VERSION: "key", generated using pwgen
can specify # length=30 on the end of it to get a length injected

Working on https://git.autonomic.zone/coop-cloud/abra/issues/32#issuecomment-1828. Rules are: - `SECRET.*PASSW.*D.*VERSION`: "password", generated using `pwqgen` - `SECRET.*KEY.*VERSION`: "key", generated using `pwgen` - can specify `# length=30` on the end of it to get a length injected

decentral1se commented

2020-11-02 11:13:31 +00:00

Instead of the lolz PASSW.*D hack, I'm gonna include the rewrite of env vars under https://git.autonomic.zone/coop-cloud/gardening/issues/1 along with this PR so we can go on with a cleaner slate.

Instead of the lolz `PASSW.*D` hack, I'm gonna include the rewrite of env vars under https://git.autonomic.zone/coop-cloud/gardening/issues/1 along with this PR so we can go on with a cleaner slate.

decentral1se commented

2020-11-05 13:20:57 +00:00

New parsing logic seems to be working. For passwords:

➜  ~ SECRET="SECRET_DB_PASSWORD_VERSION=v1 # length=15"                                   
➜  ~ LENGTH=$(echo $SECRET | sed -e 's/.*[^0-9]([0-9]+)[^0-9]*$/1/')
➜  ~ SECRET=${SECRET%_VERSION=*}
➜  ~ SECRET=${SECRET#SECRET_}   
➜  ~ echo $SECRET $LENGTH
DB_PASSWORD 15

And keys with same logic:

➜  ~ SECRET="SECRET_DB_KEY_VERSION=v1 # length=60" 
➜  ~ LENGTH=$(echo $SECRET | sed -e 's/.*[^0-9]([0-9]+)[^0-9]*$/1/')
➜  ~ SECRET=${SECRET%_VERSION=*}                                        
➜  ~ SECRET=${SECRET#SECRET_}                                           
➜  ~ echo $SECRET $LENGTH                                               
DB_KEY 60

Then I will just grep for PASSWORD/KEY to determine pwgen/pwqgen` use.

Sorry for the nightmarish regex but I couldn't figure it out any simpler.

New parsing logic seems to be working. For passwords: ``` ➜ ~ SECRET="SECRET_DB_PASSWORD_VERSION=v1 # length=15" ➜ ~ LENGTH=$(echo $SECRET | sed -e 's/.*[^0-9]([0-9]+)[^0-9]*$/1/') ➜ ~ SECRET=${SECRET%_VERSION=*} ➜ ~ SECRET=${SECRET#SECRET_} ➜ ~ echo $SECRET $LENGTH DB_PASSWORD 15 ``` And keys with same logic: ``` ➜ ~ SECRET="SECRET_DB_KEY_VERSION=v1 # length=60" ➜ ~ LENGTH=$(echo $SECRET | sed -e 's/.*[^0-9]([0-9]+)[^0-9]*$/1/') ➜ ~ SECRET=${SECRET%_VERSION=*} ➜ ~ SECRET=${SECRET#SECRET_} ➜ ~ echo $SECRET $LENGTH DB_KEY 60 ``` Then I will just `grep` for `PASSWORD/KEY` to determine `pwgen/`pwqgen` use. Sorry for the nightmarish regex but I couldn't figure it out any simpler.

decentral1se commented

2020-11-05 14:55:40 +00:00

➜  coop-cloud-apps (main) ✔ abra app order.biobulkbende.org secret auto                  
Generating db_password, version: v1, length: 32                    
Password: broken5Adam-Cotton
Generating db_root_password, version: v1, length: 32
Password: warp=soviet-whig
Generating shared_lists_db_password, version: v1, length: 32
Password: Detail9Coal8sunny
Generating smtp_password, version: v1, length: 32
Password: Lip!Eddy4ripple
Generating key_base, version: v1, length: 30
Password: iekobuP3lahs8eiko4thieKooghiKe
➜  coop-cloud-apps (main) ✔ docker secret rm $(docker secret ls -q)    
ttdx6gittpc2w7wo2n157vgyt                 
e3rm1d6kyias130vnzc1glt7q
x1ar2ts2kl9573ps26qknv8ik
s5prf28sgzc253ecgjre85wgc
0hy35x3ihc1zh41vxfz4agza2

``` ➜ coop-cloud-apps (main) ✔ abra app order.biobulkbende.org secret auto Generating db_password, version: v1, length: 32 Password: broken5Adam-Cotton Generating db_root_password, version: v1, length: 32 Password: warp=soviet-whig Generating shared_lists_db_password, version: v1, length: 32 Password: Detail9Coal8sunny Generating smtp_password, version: v1, length: 32 Password: Lip!Eddy4ripple Generating key_base, version: v1, length: 30 Password: iekobuP3lahs8eiko4thieKooghiKe ➜ coop-cloud-apps (main) ✔ docker secret rm $(docker secret ls -q) ttdx6gittpc2w7wo2n157vgyt e3rm1d6kyias130vnzc1glt7q x1ar2ts2kl9573ps26qknv8ik s5prf28sgzc253ecgjre85wgc 0hy35x3ihc1zh41vxfz4agza2 ```

decentral1se changed title from ~~WIP: Use new PASSWORD/KEY distinction+match for secret generation~~ to PASSWORD/KEY distinction+match for secret generation

2020-11-05 14:57:00 +00:00

decentral1se referenced this issue from a commit

2020-11-05 14:57:40 +00:00

Merge pull request 'PASSWORD/KEY distinction+match for secret generation' (#33) from new-pass-keys-generation into main Reviewed-on: https://git.autonomic.zone/coop-cloud/abra/pulls/33

decentral1se merged commit b75bce531b into main

2020-11-05 14:57:40 +00:00

decentral1se referenced this pull request

2020-11-05 14:58:10 +00:00

Secret auto-generation grep pattern doesn't match arbitrary naming #32

decentral1se deleted branch new-pass-keys-generation

2020-11-06 10:20:43 +00:00

decentral1se referenced this issue from a commit