Crypt is a tool for securely storing secrets such as FileVault 2 recovery keys. It is made up of a client app, and a Django web app for storing the keys.
This Docker image contains the fully configured Crypt Django web app. A default admin user has been preconfigured, use admin/password to login. If you intend on using the server for anything semi-serious it is a good idea to change the password or add a new admin user and delete the default one.
- Secrets are encrypted in the database
- All access is audited - all reasons for retrieval and approval are logged along side the users performing the actions
- Two step approval for retrieval of secrets is enabled by default
- Approval permission can be given to all users (so just any two users need to approve the retrieval) or a specific group of users
It is recommended that you use Docker to run this, but if you wish to run directly on a host, installation instructions are over in the docs directory
Crypt 3 changed it's encryption backend, so when migrating from versions earlier than Crypt 3.0, you should first run Crypt 3.2.0 to perform the migration, and then upgrade to the latest version. The last version to support legacy migrations was Crypt 3.2.
All settings that would be entered into settings.py can also be passed into the Docker container as environment variables.
-
FIELD_ENCRYPTION_KEY- The key to use when encrypting the secrets. This is required. -
SEND_EMAIL- Crypt Server can send email notifcations when secrets are requested and approved. SetSEND_EMAILto True, and setHOST_NAMEto your server's host and URL scheme (e.g.https://crypt.example.com). For configuring your email settings, see the Django documentation. -
EMAIL_SENDER- The email address to send emaiil notifications from when secrets are requests and approved. Ensure this is verified if you are using SES. Does nothing unlessSEND_EMAIILis True. -
APPROVE_OWN- By default, users with approval permissons can approve their own key requests. By setting this to False in settings.py (or by using theAPPROVE_OWNenvironment variable with Docker), users cannot approve their own requests. -
ALL_APPROVE- By default, users need to be explicitly given approval permissions to approve key retrieval requests. By setting this to True insettings.py, all users are given this permission when they log in. -
ROTATE_VIEWED_SECRETS- With a compatible client (such as Crypt 3.2.0 and greater), Crypt Server can instruct the client to rotate the secret and re-escrow it when the secret has been viewed. Enable by setting this toTrueor by usingROTATE_VIEWED_SECRETSand setting totrue. -
HOST_NAME- Set the host name of your instance - required if you do not have control over the load balancer or proxy in front of your Crypt server (see the Django documentation). -
CSRF_TRUSTED_ORIGINS- Is a list of trusted origins expected to make requests to your Crypt instance, normally this is the hostname
Main Page:
Computer Info:
User Key Request:
Manage Requests:
Approve Request:
Key Retrieval:
