From f4b4308f16a75ec7a0551c0e1d69836e6ffad791 Mon Sep 17 00:00:00 2001 From: Peter Schiffer Date: Mon, 23 Mar 2020 19:11:44 +0100 Subject: [PATCH 1/2] Expose EASYRSA_PASSIN and EASYRSA_PASSOUT env variables By exposing these variables it's possible to configure the password from various sources by specifing env vars. This is a followup to PR #242 Fixes #365 --- doc/EasyRSA-Advanced.md | 4 ++++ easyrsa3/easyrsa | 4 ---- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/EasyRSA-Advanced.md b/doc/EasyRSA-Advanced.md index 170165c..0986358 100644 --- a/doc/EasyRSA-Advanced.md +++ b/doc/EasyRSA-Advanced.md @@ -113,3 +113,7 @@ possible terse description is shown below: signing * `EASYRSA_BATCH` (CLI: `--batch`) - enable batch (no-prompt) mode; set env-var to non-zero string to enable (CLI takes no options) + * `EASYRSA_PASSIN` (CLI: `--passin`) - allows to specify a source for password; + using any openssl password options like pass:1234 or env:var + * `EASYRSA_PASSOUT` (CLI: `--passout`) - allows to specify a source for password; + using any openssl password options like pass:1234 or env:var diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 3dc0ead..d0d1907 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -2324,10 +2324,6 @@ NL=' # Be secure with a restrictive umask [ -z "$EASYRSA_NO_UMASK" ] && umask 077 -# Ignore some env vars -EASYRSA_PASSIN= -EASYRSA_PASSOUT= - # Parse options while :; do # Separate option from value: From f390dbebc1a950256f9f202ad49d2e6feed6cdb6 Mon Sep 17 00:00:00 2001 From: Peter Schiffer Date: Thu, 26 Mar 2020 23:51:02 +0100 Subject: [PATCH 2/2] Check for EASYRSA_PASSIN and EASYRSA_PASSOUT vars in config file and refuse to continue if they are present there, as they might containg passwords. --- easyrsa3/easyrsa | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index d0d1907..c8ac368 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -1645,6 +1645,12 @@ vars_setup() { # If a vars file was located, source it # If $EASYRSA_NO_VARS is defined (not blank) this is skipped if [ -z "$EASYRSA_NO_VARS" ] && [ -n "$vars" ]; then + if grep -Eq 'EASYRSA_PASSIN|EASYRSA_PASSOUT' "$vars"; then + die "\ +Variable EASYRSA_PASSIN or EASYRSA_PASSOUT has been found in the configuration \ +file. Storing sensitive information in the configuration file is not \ +recommended - please remove it from there before continuing." + fi #shellcheck disable=SC2034 EASYRSA_CALLER=1 # shellcheck disable=SC1090