I have a program that receives a secret passphrase. The options I have are to type it in manually on the terminal or to provide it as a command line argument. This makes it hard to automate in a secure way: typically there is no terminal when the script will be run, and I don't want to pass the passphrase on the command line as it will be readable via ps and the like.

For example (on a terminal):

$ vault operator unseal
Unseal Key (will be hidden):

(it works)

$ vault operator unseal <<<"$PASSPHRASE"
Unseal Key (will be hidden): 
An error occurred attempting to ask for an unseal key. The raw error message
is shown below, but usually this is because you attempted to pipe a value
into the unseal command or you are executing outside of a terminal (tty). You
should run the unseal command from a terminal for maximum security. If this
is not an option, the unseal key can be provided as the first argument to the
unseal command. The raw error was:  file descriptor 0 is not a terminal

(it does not work)

I have managed to overcome this with

socat STDIO 'EXEC:vault operator unseal,PTY' <<<"$PASSPHRASE"

but is this a bad idea? This seems like the safest way to pass in the passphrase, though surly the creators of vault had their reasons for not accepting the passphrase on STDIN and I want to be sure I'm not doing something insecure.

  • vault operator unseal - treats - as a passphrase. It doesn't read from stdin – Xian Stannard Sep 12 '19 at 16:32
  • I guess the creators of vault subscribe to the idea that a passphrase should be entered by a human, not a program. Storing a sensitive passphrase in a file just for the purpose of feeding it into another program is "security by obscurity", not real security. By trying to enforce that the passphrase is read from a terminal they are trying to ensure a human is typing it. Unfortunately, as you have shown, this can be circumvented. Accepting the passphrase via standard input would also make life easier for authors of malware, should the passphrase leak. – Johan Myréen Sep 12 '19 at 17:28
  • If all the programs accepted passwords from stdin (or from environment, the arg list is still a no because it's visible to anyone), then where would be the market for things like sshpass? Who would still struggle while cluelessly copy-pasting tcl into an expect script? FWIW, if that vault program would've used the libc's getpass(3) function instead of rolling their own thing, it would've need something more elaborate to make it work ;-) – mosvy Sep 13 '19 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.