[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #30009 [Internal Services/Tor Sysadmin Team]: consider trocla for secrets management in puppet
#30009: consider trocla for secrets management in puppet
-----------------------------------------------------+-----------------
Reporter: anarcat | Owner: tpa
Type: project | Status: new
Priority: Low | Milestone:
Component: Internal Services/Tor Sysadmin Team | Version:
Severity: Major | Keywords:
Actual Points: | Parent ID:
Points: | Reviewer:
Sponsor: |
-----------------------------------------------------+-----------------
secrets generated by puppet currently use a custom hkdf function that is
homegrown. the ad-hoc standard for this in the puppet community i'm
usually working with is [https://github.com/duritong/trocla trocla] which
is [https://github.com/duritong/puppet-trocla well integrated with
puppet].
Trocla generates, on the fly, a strong random password for each key you
ask it. It also supports various hashing mechanisms (bcrypt, pgsql, x509,
etc) so that the Puppet client never actually sees the cleartext. It seems
like a better approach than sending the cleartext like we currently do.
So I'd like to start using this for new code and possibly convert existing
code to this, if that's acceptable.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30009>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs