2 releases
0.11.1 | Sep 13, 2024 |
---|---|
0.11.0 | Aug 16, 2024 |
#91 in #secret
75KB
1.5K
SLoC
confidant
The confidant
command provides a utility for conveniently operating on file-based secret store. It is
often used in conjunction logged
to encrypt payloads as a pre-stage, or decrypt as a post-stage. No
assumption is made regarding the nature of a payload beyond it being encrypted using streambed crypto
functions.
Running with an example encrypt followed by a decrypt
First get the executable:
cargo install streambed-confidant-cli
...or build it from this repo:
cargo build --bin confidant --release
...and make a build available on the PATH (only for cargo build
and just once per shell session):
export PATH="$PWD/target/release":$PATH
Before you can use confidant
, you must provide it with a root secret and a "secret id" (password)
to authenticate the session. Here's an example with some dummy data:
echo "1800af9b273e4b9ea71ec723426933a4" > /tmp/root-secret
We also need to create a directory for confidant
to read and write its secrets. A security feature
of the confidant
library is that the directory must have a permission of 600
for the owner user.
ACLs should then be used to control access for individual processes. Here's how the directory can be
created:
mkdir /tmp/confidant
chmod 700 /tmp/confidant
You would normally source the above secrets from your production system, preferably without them leaving your production system.
Given the root secret, encrypt some data :
echo '{"value":"SGkgdGhlcmU="}' | \
confidant --root-path=/tmp/confidant encrypt --file - --path="default/my-secret-path"
...which would output:
{"value":"EZy4HLnFC4c/W63Qtp288WWFj8U="}
That value is now encrypted with a salt.
We can also decrypt in a similar fashion:
echo '{"value":"EZy4HLnFC4c/W63Qtp288WWFj8U="}' | \
confidant --root-path=/tmp/confidant decrypt --file - --path="default/my-secret-path"
...which will yield the original BASE64 value that we encrypted.
Use --help
to discover all of the options.
Dependencies
~11–20MB
~274K SLoC