3

I'm trying to find a way to securely store data for the duration of a session - specifically it's for passwords on a jump box - so the user only needs to enter the password for a given target once in their jump-box session. Ideally I'd want to hide the data even from root.

Although I trust the people with root access, I don't necessarily trust all the programs which run as root - e.g. backups which might expose the data.

SELinux won't do - the policies available on RHEL would need a lot of work, it's not portable, and, of course, SELinux sucks.

Encryption won't work - then I need to work out where to store the key.

Running a daemon and putting the data in there / authenticating using socket credential passing, however there is some effort in implementing this, and I would like to be confident that the data was purged at the end of the session (which may not always end cleanly).

Using O_TMPFILE to create an un-named file looks like it solves a lot of problems of populating the data and cleaning up at the end of the session. But how can another process get access to the data? I suppose the answer would be to have the owning process also open a listening socket and handle requests that way - but is there an easier solution?

Should I be rethinking this completely?

3

You can use the kernel keyring (and, in particular, the keyctl command) to store your data in a secure way.

The kernel keyring has enough granularity to store keys that are available for a specific user or even for a specific session (so if you're connected using SSH and on the console, or using SSH from two different machines, the sessions will be separate from each other.)

A sample example usage is:

$ keyctl add user mypassword supersecret @s
543456789

The kernel stored a key named "mypassword", with value "supersecret", only on the session (@s, consider also @u for the user keyring.)

You can use the padd command to read from stdin instead:

$ echo -n supersecret | keyctl padd user mypassword @s
543456789

Then when you need to retrieve it:

$ keyctl print 543456789
supersecret

If you want to look it up from its description ("mypassword"), you can use the search command to do so:

$ keyctl search @s user mypassword
543456789

(And then use the ID of the key to print it using keyctl print.)

There is a lot more that the keyring can do... If you want to use it, maybe start by reading through the man page of keyctl which might give you a good idea of what operations are supported and of which keyring to use.

1
  • I've started reading the docs - I'd not come across the kernel keyring before. Interesting and a few pitfalls to trap the unwary - but it seems a sensible and well thought out mechanism. – symcbean Mar 23 '18 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.