5

I have a script that downloads bank transactions to store in a database. To get these transactions requires a password for each account. The database is encrypted and requires a key to access it. All these keys and passwords are themselves encrypted and require a master key to retreive. The script prompts for the master key, uses this to retrieve all the necessary passwords and keys, and then does its work.

Right now this script is being called manually. Automating it to run periodically is easy, except for the part of securing the master key. Simply storing it in a file in plaintext does not seem very secure, as anybody who manages to get read access to the file now has wide open access to a lot of sensitive information. Storing it in a way that the script has it (for example obfuscating it in a binary called by the script) won't work either, because then anyone who can execute the script has an attack vector there.

I have read this question, the answer there appears to be "store it in a file" with added comments suggesting not in plain text. But even if the password is not plain text, it still seems like we have to communicate to the script how to read the file somehow, such as a decryption key or something, and we are back at square one.

  • 1
    What kind of key? If it's gpg you could use something like gpg-agent. – jordanm Dec 22 '13 at 0:14
  • It's an AES-256 key. – Michael Dec 22 '13 at 0:59
  • 1
    What do you want to happen? Any method of automation will be exploitable. The root user can do anything. – Patrick Dec 22 '13 at 2:40
  • Well, minimizing the risk would be a good start. – Michael Dec 22 '13 at 6:42
  • Don't you need a password to authenticate to the database anyway? So this is not exactly a new problem. – Robin Green Dec 22 '13 at 15:08
2

Here is how I wound up solving the problem.

First, I created a separate key server that starts up at the same time as the main server. Its sole purpose is to hand out keys to authorized processes. It does this by running an md5sum on the calling binary, then seeing which keys that binary is allowed to access. The calling binary (in this case, the script, which has been compiled to an executable) requests the keys from this server and then proceeds as normal.

The key server runs all the time and maintains a keychain password in its own memory. On startup, it does not have the keychain password, and thus cannot respond to requests for keys. So before it can do this, it requires that the keychain password gets set. This can be done via a web interface or the command line and requires user interaction. This secures the system by requiring that somebody physically enter the correct password. This generally only needs to be done once per reboot, since the key server never terminates.

2

Put your keys in the environment as environment variables.

The way sites like Amazon aws and heroku recommend that you store sensitive information like keys and passwords are in environment variables.

Put the password in a text file that is readable only by you

Assuming this is a Mac or linux system:

touch foo.sh

Place the export in the file

nano foo.sh

export SOMESECRET=42

Then change the permissions

chmod 700 foo.sh

Then source the file

source foo.sh

The secret will only be available in that shell and subshells

0

Store it in the database. If you are storing unencrypted bank transactions in the database, and someone has access to the database, then they can see the bank transactions anyway, so they don't need the master key.

Unless of course the master key does other stuff besides just accessing the data... but that would be bad security practice anyway.

  • The database is not un-encrypted. – Michael Dec 22 '13 at 14:58
  • I'm a little confused. How many databases are there here? 1? 2? Are you retrieving from, and storing into, the same database? – Robin Green Dec 22 '13 at 15:06
  • Two databases, both encrypted. One stores the key to the other, as well as passwords. The other stores transaction re cords. – Michael Dec 22 '13 at 15:14
  • Where does the output of your script go? Your question says "to store in a database". Which one? – Robin Green Dec 22 '13 at 15:17
  • The second one. – Michael Dec 22 '13 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.