8000 Add --password and/or --password-file options to -keygen/-rekeygen · Issue #314 · Tarsnap/tarsnap · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Add --password and/or --password-file options to -keygen/-rekeygen #314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
mspacex opened this issue Jul 16, 2018 · 4 comments
Open

Add --password and/or --password-file options to -keygen/-rekeygen #314

mspacex opened this issue Jul 16, 2018 · 4 comments

Comments

@mspacex
Copy link
mspacex commented Jul 16, 2018 •
edited
Loading

It is normally very insecure to have passwords listed in cleartext on the command line, but when automating key generation from puppet/chef/etc, having to use expect and tricking stdin is definitely not preferable.

A compromise to having it available but not directly on the command line is to use --password-file in order to read the account password from a file rather than having on the command line, though that is litter better.

How do we keep a standard user from using it, while still making it available to puppet, etc?
@mspacex mspacex changed the title Add --passphrase and/or --passphrase-file options to -keygen/-rekeygen Add --password and/or --password-file options to -keygen/-rekeygen Jul 18, 2018
@mspacex
Copy link
Author
mspacex commented Jul 18, 2018

After looking at the code, it looks like it might be possible to pipe the password in via stdin, rather than the password prompt requiring it to be typed. I am going to verify this before dropping the branch I started, but would it be better to have this functionality documented somewhere?

@gperciva
Copy link
Member

Hmm, right. Two years ago we added this to scrypt:
Tarsnap/scrypt#34
Tarsnap/scrypt#41

and that change migrated to tarsnap via libcperciva. I think that we were waiting for the scrypt changes to be released and tested a bit more before "advertizing" this in tarsnap.

Please leave this issue open, and I'll come back to it in a few weeks once I've cleared up my current tasklist.

@mspacex
Copy link
Author
mspacex commented Jul 19, 2018

will do, thanks!

@gperciva gperciva mentioned this issue Nov 13, 2018
Merged
@cperciva
Copy link
Member

@mspacex Just re-reading this... can you clarify what you wanted to pass via stdin? A tarsnap keyfile passphrase, or the tarsnap account password?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@gperciva @cperciva @mspacex
0