nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Expose EASYRSA_PASSIN and EASYRSA_PASSOUT

Browse Source 
Also adds a check to prevent it from being present in the config file.
This still needs a unit test long term.  Closes #365.

Merge branch 'pschiffe-master'

Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
This commit is contained in:
Eric F Crist 2020-03-28 20:41:23 -05:00
commit 949931811f
No known key found for this signature in database
GPG Key ID: 72964219390D0D0E
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
doc/EasyRSA-Advanced.md
View File

@ -113,3 +113,7 @@ possible terse description is shown below:
signing
* `EASYRSA_BATCH` (CLI: `--batch`) - enable batch (no-prompt) mode; set
env-var to non-zero string to enable (CLI takes no options)
* `EASYRSA_PASSIN` (CLI: `--passin`) - allows to specify a source for password;
using any openssl password options like pass:1234 or env:var
* `EASYRSA_PASSOUT` (CLI: `--passout`) - allows to specify a source for password;
using any openssl password options like pass:1234 or env:var

10
easyrsa3/easyrsa
View File

@ -1645,6 +1645,12 @@ vars_setup() {
# If a vars file was located, source it
# If $EASYRSA_NO_VARS is defined (not blank) this is skipped
if [ -z "$EASYRSA_NO_VARS" ] && [ -n "$vars" ]; then
if grep -Eq 'EASYRSA_PASSIN|EASYRSA_PASSOUT' "$vars"; then
die "\
Variable EASYRSA_PASSIN or EASYRSA_PASSOUT has been found in the configuration \
file. Storing sensitive information in the configuration file is not \
recommended - please remove it from there before continuing."
fi
#shellcheck disable=SC2034
EASYRSA_CALLER=1
# shellcheck disable=SC1090
@ -2324,10 +2330,6 @@ NL='
# Be secure with a restrictive umask
[ -z "$EASYRSA_NO_UMASK" ] && umask 077
# Ignore some env vars
EASYRSA_PASSIN=
EASYRSA_PASSOUT=
# Parse options
while :; do
# Separate option from value: