Keep it Secret, Keep it Safe

Managing passwords in userland is tricky enough, but clever tools like 1Password and LastPass have made it easier than ever to protect our social media accounts. Two-factor authentication tools have made us safer still by preventing even weak password from being easily bypassed. Unfortunately, none of this helps us with passwords and credentials in our code.

First, we’ll define the threat models that affect secret data within our PHP apps – and how this sensitive information could be exploited. Then, we’ll survey the landscape of tools available to manage secrets safely so our data stays secure. Finally, we’ll work through the code required to tie everything together and keep our access keys both secret and safe from nefarious third parties.

Transcript

1. KEEP IT SAFE
   @ERICMANN
   

   View Slide

2. •
   •
   •
   •
   

   View Slide

3. •
   •
   •
   

   View Slide

4. • EXPOSED THE DOCKER REGISTRY FOR VINE TO THE PUBLIC
   •
   •
   

   View Slide

5. •
   •
   •
   

   View Slide

6. View Slide

7. View Slide

8. •
   •
   •
   •
   •
   

   View Slide

9. View Slide

10. •
    •
    •
    •
    •
    

    View Slide

11. •
    •
    

    View Slide

12. $ pip install credstash
    $ credstash setup
    $ credstash put database_connection_string mysql:dbname=testdb;host=127.0.0.1
    $ credstash put database_user user
    $ credstash put database_pass password
    

    View Slide

13. composer require gmo/credstash
    

    View Slide

14. $sdk = new Aws\Sdk($config);
    $credstash = CredStash\CredStash::createFromSdk($sdk);
    $dsn = $credstash->get('database_connection_string');
    $user = $credstash->get('database_user');
    $pass = $credstash->get('database_pass');
    $dbh = new PDO($dsn, $user, $pass);
    

    View Slide

15. •
    •
    •
    

    View Slide

16. View Slide

17. •
    •
    •
    •
    •
    

    View Slide

18. •
    •
    •
    

    View Slide

19. # .env
    DATABASE_CONNECTION_STRING="mysql:dbname=testdb;host=127.0.0.1"
    DATABASE_USER="user"
    DATABASE_PASS="password"
    # .gitattributes
    .env filter=git-crypt diff=git-crypt
    # .env
    ^@GITCRYPT^@<84>±<9b>ÅÛ4^M$<9a><9f><8d>Y<87><89>"-^Cb¦@T<90>¬
    ÉL%s^^_^Yð^AY<84>^[ÿ³ú}È<-
    ÞG/{OXTé¹¾<87>Ôï3c<93>_IpÀjñA^_µÅ^T<88>îm]ëk^Txbq¢^E^DÐËSªJ8³{öRè_|":6~
    ¥ý<90>^Nóp¢ô^R2X^US ^VÓÀ¾£ú¤
    $ brew install git-crypt
    $ cd ~/project
    $ git-crypt init
    $ git-crypt add-gpg-user 715376CA
    

    View Slide

20. $dotenv = new Dotenv\Dotenv(__DIR__);
    $dotenv->load();
    $dsn = get_env('DATABASE_CONNECTION_STRING');
    $user = get_env('DATABASE_USER');
    $pass = get_env('DATABASE_PASS');
    $dbh = new PDO($dsn, $user, $pass);
    $ git-crypt unlock
    

    View Slide

21. •
    •
    •
    

    View Slide

22. View Slide

23. HASHICORP VAULT
    •
    •
    •
    •
    •
    

    View Slide

24. ANSIBLE VAULT
    •
    •
    •
    

    View Slide

25. DOCKER SECRETS
    •
    •
    •
    

    View Slide

26. •
    •
    •
    •
    •
    

    View Slide

27. View Slide

28. •
    •
    •
    

    View Slide

29. •
    •
    •
    •
    

    View Slide

30. • HASHICORP'S BLOG
    • FUGUE'S BLOG
    • AWS KEY MANAGEMENT SERVICE
    • PARAGON INITIATIVE'S BLOG
    • TOZNY'S BLOG
    

    View Slide

31. KEEP IT SAFE
    @ERICMANN - TOZNY
    

    View Slide