Can You Keep a Secret?

Slides from DrupalSouth 2017, Auckland NZ.

Transcript

1. Can You Keep a Secret DrupalSouth 2017 - Auckland
2. Nick Santamaria • Drupal developer since 2006 • SysOps Engineer at PreviousNext • HashiCorp fanboi • @nicksanta • drupal.org/user/87915
3. Secret Management Crash Course
4. Are you in the right place?
5. What are Secrets?
6. Passwords • Database • Cache Backend • Search Index • Document Store
7. API Keys • Cloud Platform • Payment Processor • Email Marketing • CI / CD Pipeline
8. Cryptographic Keys • SSH Key Pairs • TLS Certificates • AES Encryption Keys
9. Kinda-but-not-really Secrets • Financial Credentials • Confidential Data • Personally Identifiable Information (PII)
10. Telling Secrets to the Application
11. Stored in Repo
12. Stored in Repo
13. Stored in Database
14. Placed by Config Management • Puppet • Ansible • CloudFormation • Terraform Variation Complication Baked into AMI AMI per security boundary Encrypted secrets in code Orchestrating key distribution
15. Hand Crafted Config
16. So What's the Problem?
17. "Secret Sprawl"
18. Impossible to Audit
19. Difficulty Rotating Keys
20. What Happens When You're Compromised?
22. Secret Management The Solution
23. Secret Management SOLUTION Centralise storage PROBLEM "Secret Sprawl"
24. Secret Management SOLUTION Authentication layer Standardised policy framework PROBLEM Who has access?
25. Secret Management SOLUTION Audit logs PROBLEM Who accessed what and when did they do it?
26. SOLUTION Centralised storage Leases Dynamic secrets Secret Management PROBLEM Rotating secrets is time consuming and error prone
27. SOLUTION Well-defined "break-glass" procedure Secret Management PROBLEM
28. Drupal Recipes
29. Store API Tokens in Lockr Recipe #1
30. Setup - Services • Lockr - lockr.io • MailChimp - mailchimp.com
31. Setup - Code • Drupal 8.4 • drupal.org/project/mailchimp • drupal.org/project/lockr • drupal.org/project/key ◦ ^1.4 (1.x-dev for now)
32. Demo
33. Config Export - Before api_key: 8b777e6f871ae009da60c54db84b7eb621a296d9 cron: false batch_limit: 100 api_classname: Mailchimp\Mailchimp test_mode: false drupal-project / config-export / mailchimp.settings.yml
34. Config Export - After api_key: null cron: false batch_limit: 100 api_classname: Mailchimp\Mailchimp test_mode: false drupal-project / config-export / mailchimp.settings.yml ←
35. Config Export - After dependencies: module: - lockr - mailchimp id: mailchimp_token label: 'MailChimp Token' description: 'API token for mailchimp integration' key_provider: lockr key_provider_settings: encoded: aes-128-ctr-sha256$nHlAw2BcTCHVTGQ01kDe9psWgItkrZ55qY4xV36BbGo=$+xgMdEzk6lsDy21h9j…. key_input: text_field drupal-project / config-export / key.key.mailchimp_token.yml } Key safely stored in lockr storage provider
36. Config Export - After status: true dependencies: config: - key.key.mailchimp_token - mailchimp.settings id: mailchimp_api label: 'MailChimp API' config_type: system.simple config_name: mailchimp.settings config_item: api_key key_id: mailchimp_token drupal-project / config-export / key.config_override.mailchimp_token.yml } mailchimp.api_key config now overridden by key.repository.mailchimp_token
37. • Attackers can't obtain API keys from ◦ DB leaks ◦ Codebase leaks ◦ Stolen developer machine Advantages
38. Encrypt Fields with KMS Recipe #2
39. Setup - Services • AWS • IAM User • KMS Key
40. Setup - Code • Drupal 8.4 • drupal.org/project/key • drupal.org/project/encrypt • drupal.org/project/field_encrypt • Encrypt KMS ◦ drupal.org/sandbox/nickurbits/2923717
41. Demo
42. • Sensitive data not exposed in DB leak • Decryption key not stored in codebase • Rotating AWS API token doesn't break encryption. Advantages
43. Dynamic Database Credentials with Vault Recipe #3
44. Setup • Drupal • HashiCorp Vault ◦ vaultproject.io • Consul Template ◦ github.com/hashicorp/consul-template
45. Setup - Vault $ vault mount database Successfully mounted 'database' at 'database'! Mount the database secret backend
46. $ vault write database/config/mysql \ plugin_name=mysql-database-plugin \ allowed_roles="drupal" \ connection_url= "root:${MYSQL_ROOT_PASSWORD}@tcp(127.0.0.1:3306)/" Setup - Vault Give Vault root access to database
47. $ vault write database/roles/drupal \ db_name=mysql \ default_ttl="15s" \ max_ttl="20s" \ creation_statements=" CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'; GRANT ALL PRIVILEGES ON *.* TO '{{name}}'@'%';" Setup - Vault Create "drupal" role in Vault
48. $ vault read database/creds/drupal Key Value --- ----- lease_id database/creds/drupal/9939e3b1-f370-f07d-c960-... lease_duration 1m0s lease_renewable true password A1a-07p018125t60921y username v-token-drupal-u10y6tt86y1wts01u Setup - Vault Test credentials are being generated } Created on the fly
49. Setup - Consul Template <?php {{ with secret "database/creds/drupal" }} $databases['default']['default'] = [ // Dynamic credentials generated by Vault - {{ timestamp }} 'username' => '{{ .Data.username }}', 'password' => '{{ .Data.password }}', ]; {{ end }} drupal-project / consul-template / settings.php.ctmpl
50. $ TEMPLATE=consul-template/settings.php.ctmpl $ RENDERED=app/sites/default/vault.settings.php $ consul-template -template $TEMPLATE:$RENDERED Setup - Consul Template Run Consul Template
51. Demo
52. • Constant rotation of secrets • Credentials probably junk by time Attacker tries to use them. • Risk posed by "Hoarders" mitigated. Advantages
53. @nicksanta drupal.org/user/87915 Fin.