Task #8704
closedTask #8732: [EPIC] As a user, I can rest easy with all sensitive credentials in the database encrypted at rest
Installer: create a key for pulp to use when encrypting sensitive db fields
100%
Description
#8192 encrypts fields in our database using a private key. We need to have the installer generate this key. Pulp will read in this key and use it to encrypt/decrypt sensitive fields in our database.
From #8192:
The private key will need to be generated at install time. We need to determine where to keep these by default securely. They need to be readable by code without a human involved.
Updated by daviddavis over 3 years ago
- Blocks Story #8192: Add code to pulpcore that uses the db key to encrypt fields added
Updated by daviddavis over 3 years ago
Here's how to generate the key:
dd if=/dev/urandom bs=32 count=1 2>/dev/null | openssl base64
Updated by mdepaulo@redhat.com over 3 years ago
- Assignee set to mdepaulo@redhat.com
Updated by daviddavis over 3 years ago
- Blocks deleted (Story #8192: Add code to pulpcore that uses the db key to encrypt fields)
Updated by mdepaulo@redhat.com over 3 years ago
Needs to be done by the end of sprint 97. (per daviddavis)
Updated by pulpbot about 3 years ago
- Status changed from ASSIGNED to POST
Added by Mike DePaulo about 3 years ago
Added by Mike DePaulo about 3 years ago
Revision f196208b | View on GitHub
Create or import a key for pulp-api to use when
encrypting sensitive db fields.
Introduces new variables pulp_db_fields_key
& pulp_db_fields_key_remote
.
fixes: #8704 Create a key for pulp to use when encrypting sensitive db fields https://pulp.plan.io/issues/8704
Updated by daviddavis about 3 years ago
- Subject changed from Create a key for pulp to use when encrypting sensitive db fields to Installer: create a key for pulp to use when encrypting sensitive db fields
Updated by Anonymous about 3 years ago
- Status changed from POST to MODIFIED
- % Done changed from 0 to 100
Applied in changeset ansible-pulp|f196208b282b702fcebc00d84d048a6ea59126ae.
Added by daviddavis about 3 years ago
Revision 9a7291f9 | View on GitHub
Use openssl to generate db key
ref #8704
Added by daviddavis about 3 years ago
Revision 9a7291f9 | View on GitHub
Use openssl to generate db key
ref #8704
Updated by pulpbot about 3 years ago
Added by William Bradford Clark about 3 years ago
Revision b45ade85 | View on GitHub
Use url-safe base64 encoding for Fernet key
Fernet.generate_key() (from Python's cryptography.fernet module) generates 32 pseudorandom bytes in url-safe base64-encoded form, i.e. using the url-safe base64 alphabet described in https://datatracker.ietf.org/doc/html/rfc4648#section-5
This commit converts the output from the openssl command used to generate the Fernet key to the same url-safe base64 alphabet. This is technically not required as Python's urlsafe_b64decode function will translate to the url-safe alphabet when loading the key; however we might as well store the key using the same base64 alphabet which is used internally by cryptography.frenet
refs: #8704
Added by William Bradford Clark about 3 years ago
Revision b45ade85 | View on GitHub
Use url-safe base64 encoding for Fernet key
Fernet.generate_key() (from Python's cryptography.fernet module) generates 32 pseudorandom bytes in url-safe base64-encoded form, i.e. using the url-safe base64 alphabet described in https://datatracker.ietf.org/doc/html/rfc4648#section-5
This commit converts the output from the openssl command used to generate the Fernet key to the same url-safe base64 alphabet. This is technically not required as Python's urlsafe_b64decode function will translate to the url-safe alphabet when loading the key; however we might as well store the key using the same base64 alphabet which is used internally by cryptography.frenet
refs: #8704
Added by William Bradford Clark about 3 years ago
Revision e61d7fdc | View on GitHub
Fix typo in pulp_db_fields_key documentation
refs: #8704
Added by William Bradford Clark about 3 years ago
Revision e61d7fdc | View on GitHub
Fix typo in pulp_db_fields_key documentation
refs: #8704
Added by William Bradford Clark about 3 years ago
Revision b6e7a069 | View on GitHub
Use 0640 filemode for Fernet keyfile
refs: #8704
Added by William Bradford Clark about 3 years ago
Revision b6e7a069 | View on GitHub
Use 0640 filemode for Fernet keyfile
refs: #8704
Updated by bmbouter about 3 years ago
- Status changed from MODIFIED to CLOSED - CURRENTRELEASE
Updated by daviddavis about 3 years ago
- Parent issue changed from #8192 to #8732
Create or import a key for pulp-api to use when
encrypting sensitive db fields.
Introduces new variables
pulp_db_fields_key
&pulp_db_fields_key_remote
.fixes: #8704 Create a key for pulp to use when encrypting sensitive db fields https://pulp.plan.io/issues/8704