Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cli: --init-token exposes the init token to the ps command #61231

Open
knz opened this issue Feb 28, 2021 · 1 comment
Open

cli: --init-token exposes the init token to the ps command #61231

knz opened this issue Feb 28, 2021 · 1 comment
Labels
A-authentication Pertains to authn subsystems A-security C-bug Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior. T-server-and-security DB Server & Security
Projects
DB Server & Security

Comments

@knz
Copy link
Contributor

knz commented Feb 28, 2021 •
edited

Related to #60632

The current definition of the --init-token flag exposes the shared secret string to other users on the machine via the ps command.

Is this OK?

It seems to me that we instead want a --init-token-file and have the value of the token stored in a file instead. WDYT?

Jira issue: CRDB-3050
Epic: CRDB-6663
@knz knz added C-bug Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior. A-security labels Feb 28, 2021
@knz knz added this to To do in DB Server & Security via automation Feb 28, 2021
@aaron-crl
Copy link

I would prefer to offer both but if I had to pick only one, I'd keep this and advise security sensitive users to use an environment variable. The former still reduces the steps to get running in a cluster.

The latter makes integration with k8s secrets easier.

@knz knz mentioned this issue Mar 1, 2021
Closed
25 tasks
@jlinder jlinder added the T-server-and-security DB Server & Security label Jun 16, 2021
@knz knz added the A-authentication Pertains to authn subsystems label Jul 29, 2021
@knz knz moved this from To do to Linked issues (from the roadmap columns on the right) in DB Server & Security Jul 29, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
A-authentication Pertains to authn subsystems A-security C-bug Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior. T-server-and-security DB Server & Security
Projects
DB Server & Security
  
Linked issues (from the roadmap colum...
Milestone
No milestone
Development

No branches or pull requests
4 participants
@jlinder @itsbilal @knz @aaron-crl