SMTP_PASSWORD: better to keep secret

[CharlesMAtkinson]

I write with knowledge of Linux, not other OSes.

Ideally Vaultwarden's SMTP_PASSWORD would be secret so:

• Not kept in plain text on the file system
• Not passed on the command line
• Not passed as an environment variable

All three could be satisfied by a new Vaultwarden feature to configure SMTP in the UI rather than by environment variables.

[BlackDex]

And where would we then save this password safely entered in via the UI? Somewhere in a file like config.json maybe?

[CharlesMAtkinson]

If using HTTPS would it not be safe to enter the password via the UI?
I guess that Vaultwarden encrypts a lot of data and stores it in its database using the data owner's password as an encryption key. Could Vaultwarden not have its own per-instance randomly generated encryption key to similarly store the SMTP password in its database?
Sorry if my solution suggestions are naive. It is not my area of expertise. I started this thread to highlight a security problem, not to solve it.

[BlackDex]

Well, that security key needs to be stored somewhere too to be used to decrypt stored data. Which in the end makes that encryption kinda useless, since when someone is able to access your server, they have access to that security key too.

It will make it a bit harder maybe, but definitely not more secure.

[CharlesMAtkinson]

There is no absolutely secure. All security improvements are making it "a bit harder". The least secure situation is when someone has physical access to a server or backup storage. Next is root access. We take care to make both of those difficult. Next is unprivileged user access which is the hardest to prevent.

In the current arrangement, an unprivileged user can display the docker run command with the --env options including the SMTP password

$ ps -eF | grep 'docker ru[n]'
...  /usr/bin/docker run --name vaultwarden ... --env SMTP_PASSWORD=<redacted> ... --volume /var/vaultwarden/:/data/ --restart unless-stopped --publish 8080:80 vaultwarden/server:latest

[BlackDex]

You should put those in a .env file, or use docker secrets, never on the CLI. If you adhere to bast practices, then having those items in the command is a no-go from the start. And Vaultwarden provides other ways of storing those values instead of having to use a multitude of --env options which is just not usable.

[CharlesMAtkinson]

Thanks BlackDex. Good advice. My implementation was based on https://github.com/dani-garcia/vaultwarden/wiki/SMTP-configuration.

A better solution which addresses all my concerns in this thread's opening post is to use an environment file encrypted by systemd. IIUC it also solves your "Well, that security key needs to be stored somewhere too to be used to decrypt stored data. Which in the end makes that encryption kinda useless, since when someone is able to access your server, they have access to that security key too" if the server has TPM.

Here's how I implemented it

• Create (and test) a temporary Docker environment file

DOMAIN=https://<redacted>
SMTP_FROM=<redacted>
SMTP_HOST=smtp.<redacted>
SMTP_PASSWORD=<redacted>
SMTP_PORT=587
SMTP_SECURITY=starttls
SMTP_USERNAME=<redacted>

• Generate a systemd credentials pretty print string of the temporary Docker environment file
  # cat <path to environment file> | systemd-creds encrypt --name=vaultwarden-env-file --pretty - -

• Create a systemd service file incorporating the pretty print

[Unit]
Description=Vaultwarden web password manager
BindsTo=docker.service
After=docker.service

[Service]
Environment=NAME=vaultwarden
ExecStartPre=-/usr/bin/docker kill ${NAME}
ExecStartPre=-/usr/bin/docker rm ${NAME}
SetCredentialEncrypted=vaultwarden-env-file: \
        Whx<redacted>Yw==
ExecStart=/usr/bin/docker run --name ${NAME} --env-file %d/vaultwarden-env-file \
    --volume /var/vaultwarden/:/data/ --restart unless-stopped \
    --publish 8080:80 vaultwarden/server:latest
ExecStop=/usr/bin/docker stop ${NAME}

[Install]
WantedBy=multi-user.target

• Reload systemd
  # systemctl daemon-reload

• Remove the temporary Docker environment file

[rob4226]

Can we add a new environment variable called SMTP_PASSWORD_FILE that would take precedence over the existing SMTP_PASSWORD variable and allow passing a file path so that Docker secrets can be used? Like SMTP_PASSWORD_FILE: '/run/secrets/smtp-password'.

Accepting a file path would also allow systemd encrypted credentials to be used on non-Docker installs.

[stefan0xC]

That mechanism is already implemented. See the Loading individual values from files section of the configuration overview for more information.

[rob4226]

O wow nice thanks! I totally missed that lol.