I have a program that receives a secret passphrase. The options I have are to type it in manually on the terminal or to provide it as a command line argument. This makes it hard to automate in a secure way: typically there is no terminal when the script will be run, and I don't want to pass the passphrase on the command line as it will be readable via
ps and the like.
For example (on a terminal):
$ vault operator unseal Unseal Key (will be hidden):
$ vault operator unseal <<<"$PASSPHRASE" Unseal Key (will be hidden): An error occurred attempting to ask for an unseal key. The raw error message is shown below, but usually this is because you attempted to pipe a value into the unseal command or you are executing outside of a terminal (tty). You should run the unseal command from a terminal for maximum security. If this is not an option, the unseal key can be provided as the first argument to the unseal command. The raw error was: file descriptor 0 is not a terminal
(it does not work)
I have managed to overcome this with
socat STDIO 'EXEC:vault operator unseal,PTY' <<<"$PASSPHRASE"
but is this a bad idea? This seems like the safest way to pass in the passphrase, though surly the creators of
vault had their reasons for not accepting the passphrase on STDIN and I want to be sure I'm not doing something insecure.