ENH: passwords are shown in cleartext in intelmq-manager

[aaronkaplan]

We need to come up with a better way to store the authentication tokens needed for the config files.

[sebix]

Save them symmetrically encrypted and the password is asked by intelmqctl/intelmq-manager when the bot starts?

IMHO the sysadmins have to ensure that the configuration files have to be protected. intelmq is not special in any other way, the same applies for all other server-software including web-applications and credentials for databases, mail servers and credentials for lookup mechanisms, private keys in all variants etc.

[aaronkaplan]

---

Mobile

On 07.10.2015, at 20:36, Sebastian notifications@github.com wrote:

Save them symmetrically encrypted and the password is asked by intelmqctl/intelmq-manager when the bot starts?

Nahhh. Also not good.
As said I am not sure what's the best way.

IMHO the sysadmins have to ensure that the configuration files have to be protected. intelmq is not special in any other way, the same applies for all other server-software including web-applications and credentials for databases, mail servers and credentials for lookup mechanisms, private keys in all variants etc.

I know. But seeing an unencrypted pwd over http:// in intelmq-manager is - disappointing :)

Anyway. Not a prio right now. But I documented it so that we don't forget.

—
Reply to this email directly or view it on GitHub.

Passwords could be hidden in the interface by default and only shown if the use clicks a button ("eye" symbol right of the input field?)