From e26e7e29f237e7f9dc8e6f5f1b33dd4cc4763223 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Tue, 14 Jul 2015 13:49:51 +0100 Subject: [PATCH] Improvements to password handling recommendations --- site/features.md | 9 +++++++-- site/systemd.md | 8 +++++--- test/110_encryption_test.sh | 4 ++-- 3 files changed, 14 insertions(+), 7 deletions(-) diff --git a/site/features.md b/site/features.md index e25d63e1..9ef088a4 100644 --- a/site/features.md +++ b/site/features.md @@ -245,16 +245,21 @@ In order to connect containers across untrusted networks, weave peers can be told to encrypt traffic by supplying a `-password` option or `WEAVE_PASSWORD` environment variable when launching weave, e.g. - host1$ weave launch -password wEaVe + host1$ weave launch -password wfvAwt7sj or - host1$ export WEAVE_PASSWORD=wEaVe + host1$ export WEAVE_PASSWORD=wfvAwt7sj host1$ weave launch _NOTE: The command line option takes precedence over the environment variable._ +> To avoid leaking your password via the kernel process table or your +> shell history, we recommend you store it in a file and capture it +> into a shell variable prior to launching weave: `export +> WEAVE_PASSWORD=$(cat /path/to/password-file)` + The password needs to be reasonably strong to guard against online dictionary attacks. We recommend at least 50 bits of entropy. An easy way to generate a random password which satsifies this requirement is diff --git a/site/systemd.md b/site/systemd.md index 7f4bda07..9f366fc2 100644 --- a/site/systemd.md +++ b/site/systemd.md @@ -38,9 +38,11 @@ the following format: You can also use the [connect][] command to add participating hosts dynamically. -Additionally, if you want to enable [encryption][] you can specify a password with -`WEAVE_PASSWORD="MakeSureThisIsSecure"` in the `/etc/sysconfig/weave` environment -file, and it will get picked up by weave on launch. +Additionally, if you want to enable [encryption][] you can specify a +password with e.g. `WEAVE_PASSWORD="wfvAwt7sj"` in the +`/etc/sysconfig/weave` environment file, and it will get picked up by +weave on launch. Recommendations for choosing a suitably strong +password can be found [here](features.html#security). You now should be able to launch weave with diff --git a/test/110_encryption_test.sh b/test/110_encryption_test.sh index 967e0003..27761823 100755 --- a/test/110_encryption_test.sh +++ b/test/110_encryption_test.sh @@ -7,8 +7,8 @@ C2=10.2.1.7 start_suite "Ping over encrypted cross-host weave network" -weave_on $HOST1 launch -password notverysecure -weave_on $HOST2 launch -password notverysecure $HOST1 +weave_on $HOST1 launch -password wfvAwt7sj +weave_on $HOST2 launch -password wfvAwt7sj $HOST1 start_container $HOST1 $C1/24 --name=c1 start_container $HOST2 $C2/24 --name=c2