Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Keep it Secret, Keep it Safe

Keep it Secret, Keep it Safe

Managing passwords in userland is tricky enough, but clever tools like 1Password and LastPass have made it easier than ever to protect our social media accounts. Two-factor authentication tools have made us safer still by preventing even weak password from being easily bypassed. Unfortunately, none of this helps us with passwords and credentials in our code.

First, we’ll define the threat models that affect secret data within our PHP apps – and how this sensitive information could be exploited. Then, we’ll survey the landscape of tools available to manage secrets safely so our data stays secure. Finally, we’ll work through the code required to tie everything together and keep our access keys both secret and safe from nefarious third parties.

Eric Mann

June 02, 2017
Tweet

More Decks by Eric Mann

Other Decks in Technology

Transcript

  1. KEEP IT SAFE
    @ERICMANN

    View Slide





  2. View Slide




  3. View Slide

  4. • EXPOSED THE DOCKER REGISTRY FOR VINE TO THE PUBLIC


    View Slide




  5. View Slide

  6. View Slide

  7. View Slide






  8. View Slide

  9. View Slide






  10. View Slide



  11. View Slide

  12. $ pip install credstash
    $ credstash setup
    $ credstash put database_connection_string mysql:dbname=testdb;host=127.0.0.1
    $ credstash put database_user user
    $ credstash put database_pass password

    View Slide

  13. composer require gmo/credstash

    View Slide

  14. $sdk = new Aws\Sdk($config);
    $credstash = CredStash\CredStash::createFromSdk($sdk);
    $dsn = $credstash->get('database_connection_string');
    $user = $credstash->get('database_user');
    $pass = $credstash->get('database_pass');
    $dbh = new PDO($dsn, $user, $pass);

    View Slide




  15. View Slide

  16. View Slide






  17. View Slide




  18. View Slide

  19. # .env
    DATABASE_CONNECTION_STRING="mysql:dbname=testdb;host=127.0.0.1"
    DATABASE_USER="user"
    DATABASE_PASS="password"
    # .gitattributes
    .env filter=git-crypt diff=git-crypt
    # .env
    ^@GITCRYPT^@<84>±<9b>ÅÛ4^M$<9a><9f><8d>Y<87><89>"-^Cb¦@T<90>¬
    ÉL%s^^_^Yð^AY<84>^[ÿ³ú}È<-
    ÞG/{OXTé¹¾<87>Ôï3c<93>_IpÀjñA^_µÅ^T<88>îm]ëk^Txbq¢^E^DÐËSªJ8³{öRè_|":6~
    ¥ý<90>^Nóp¢ô^R2X^US ^VÓÀ¾£ú¤
    $ brew install git-crypt
    $ cd ~/project
    $ git-crypt init
    $ git-crypt add-gpg-user 715376CA

    View Slide

  20. $dotenv = new Dotenv\Dotenv(__DIR__);
    $dotenv->load();
    $dsn = get_env('DATABASE_CONNECTION_STRING');
    $user = get_env('DATABASE_USER');
    $pass = get_env('DATABASE_PASS');
    $dbh = new PDO($dsn, $user, $pass);
    $ git-crypt unlock

    View Slide




  21. View Slide

  22. View Slide

  23. HASHICORP VAULT





    View Slide

  24. ANSIBLE VAULT



    View Slide

  25. DOCKER SECRETS



    View Slide






  26. View Slide

  27. View Slide




  28. View Slide





  29. View Slide

  30. • HASHICORP'S BLOG
    • FUGUE'S BLOG
    • AWS KEY MANAGEMENT SERVICE
    • PARAGON INITIATIVE'S BLOG
    • TOZNY'S BLOG

    View Slide

  31. KEEP IT SAFE
    @ERICMANN - TOZNY

    View Slide