Improvements to password handling recommendations

site/features.md

@@ -245,16 +245,21 @@ In order to connect containers across untrusted networks, weave peers
 can be told to encrypt traffic by supplying a `-password` option or
 `WEAVE_PASSWORD` environment variable when launching weave, e.g.
 
-    host1$ weave launch -password wEaVe
+    host1$ weave launch -password wfvAwt7sj
 
 or
 
-    host1$ export WEAVE_PASSWORD=wEaVe
+    host1$ export WEAVE_PASSWORD=wfvAwt7sj
     host1$ weave launch
 
 _NOTE: The command line option takes precedence over the environment
 variable._
 
+> To avoid leaking your password via the kernel process table or your
+> shell history, we recommend you store it in a file and capture it
+> into a shell variable prior to launching weave: `export
+> WEAVE_PASSWORD=$(cat /path/to/password-file)`
+
 The password needs to be reasonably strong to guard against online
 dictionary attacks. We recommend at least 50 bits of entropy. An easy
 way to generate a random password which satsifies this requirement is

site/systemd.md

@@ -38,9 +38,11 @@ the following format:
 
 You can also use the [connect][] command to add participating hosts dynamically.
 
-Additionally, if you want to enable [encryption][] you can specify a password with
-`WEAVE_PASSWORD="MakeSureThisIsSecure"` in the `/etc/sysconfig/weave` environment
-file, and it will get picked up by weave on launch.
+Additionally, if you want to enable [encryption][] you can specify a
+password with e.g. `WEAVE_PASSWORD="wfvAwt7sj"` in the
+`/etc/sysconfig/weave` environment file, and it will get picked up by
+weave on launch. Recommendations for choosing a suitably strong
+password can be found [here](features.html#security).
 
 You now should be able to launch weave with
 

test/110_encryption_test.sh

@@ -7,8 +7,8 @@ C2=10.2.1.7
 
 start_suite "Ping over encrypted cross-host weave network"
 
-weave_on $HOST1 launch -password notverysecure
-weave_on $HOST2 launch -password notverysecure $HOST1
+weave_on $HOST1 launch -password wfvAwt7sj
+weave_on $HOST2 launch -password wfvAwt7sj $HOST1
 
 start_container $HOST1 $C1/24 --name=c1
 start_container $HOST2 $C2/24 --name=c2