-
Notifications
You must be signed in to change notification settings - Fork 60
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add to for Secrets to be generated before generating secrets #226
Merged
Merged
Changes from all commits
Commits
Show all changes
20 commits
Select commit
Hold shift + click to select a range
fa20607
Add to for Secrets to be generated before generating secrets
DonRichards 1635054
Copy the defaults over if disabled
DonRichards a523c07
Add no clobber to the copy process
DonRichards 889a945
Phrase reversed is message.
DonRichards 3d25784
Update docs for SECRETS
DonRichards 0604e8a
Added more info and tests to check secrets
DonRichards 26a05e2
typo
DonRichards 583e055
Fix exit when all no to prompts
DonRichards 287a40e
Switch hash to md5 instead of sha1 because sha1 isn't n macs by default
DonRichards 4b5a649
Add automation for generator script with docs
DonRichards f7ab6d1
OS detect to determine which command to use to check hashes
DonRichards 412426a
move mac specific hash to cat the files
DonRichards 2e13e9a
Remove the exclude in 'ls' check
DonRichards e3a1f9a
Correct the secret name variable
DonRichards 1938af9
Merge branch 'development' into fix_secrets_check
DonRichards a735794
Add Salt warning
DonRichards 369990b
Improve warning
DonRichards a16d9ed
Merge branch 'development' into fix_secrets_check
DonRichards f9dccda
Correct salt warning
DonRichards dae6b1a
Remove unneeded comments
DonRichards File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,170 @@ | ||
| #!/usr/bin/env bash | ||
| set -e | ||
|
|
||
| RED=$(tput -Txterm setaf 1) | ||
| GREEN=$(tput -Txterm setaf 2) | ||
| YELLOW=$(tput -Txterm setaf 3) | ||
| BLUE=$(tput -Txterm setaf 4) | ||
| RESET=$(tput -Txterm sgr0) | ||
| TARGET_MAX_CHAR_NUM=20 | ||
|
|
||
| source .env || { | ||
| echo "${RED}ERROR: .env file not found.${RESET}" | ||
| exit 1 | ||
| } | ||
| FOUND_INSECURE_SECRETS=false | ||
|
|
||
| function print_security_warning() { | ||
| if [ "${FOUND_INSECURE_SECRETS}" == true ]; then | ||
| cat << EOF | ||
|
|
||
|
|
||
| ${YELLOW} --- --- WARNING --- --- ${RESET}${RED} --- --- WARNING --- --- ${RESET} | ||
|
|
||
| ${RED} | ||
| Using default values for secrets in a production environment is a | ||
|
|
||
| Security Risk${RESET} | ||
|
|
||
| Default values are identified in ${GREEN}$(pwd)/secrets/live/${RESET} | ||
|
|
||
| If you are using the default values, you can either change the values of | ||
| the file found in $(pwd)/secrets/live/ | ||
| Or generate new secrets by running: | ||
| ${GREEN}make generate-secrets ${RESET} | ||
|
|
||
| This will generate new secrets in /secrets/live/ but will not update | ||
| the ISLE containers. | ||
|
|
||
| If you are not sure how to push updated secrets to ISLE, please consult | ||
| the documentation.${BLUE} | ||
| https://islandora.github.io/documentation/installation/docker-custom/#secrets | ||
| ${RESET} | ||
|
|
||
| ${YELLOW} --- --- WARNING --- --- ${RESET}${RED} --- --- WARNING --- --- ${RESET} | ||
|
|
||
|
|
||
| EOF | ||
| fi | ||
| } | ||
|
|
||
| function main() { | ||
| unameOut="$(uname -s)" | ||
| case "${unameOut}" in | ||
| Linux*) hash=sha1sum;; | ||
| *) hash="UNKNOWN" | ||
| esac | ||
| # Check if $USE_SECRETS is set to true. | ||
| if [ "$USE_SECRETS" = true ]; then | ||
| local secret_live=[]; | ||
| # Check if the $(pwd)/secrets/live directory is empty. | ||
| if [ "$(ls $(pwd)/secrets/live)" ]; then | ||
| local secret_live=($(find $(pwd)/secrets/live/* -exec basename {} \;)) | ||
| fi | ||
| fi | ||
|
|
||
| local secret_templates=($(find $(pwd)/secrets/template/* -exec basename {} \;)) | ||
|
|
||
| if [ ! "$(ls $(pwd)/secrets/live)" ]; then | ||
| echo -e "\n${YELLOW}Checking secrets...${RESET}" | ||
| echo " No secrets found in $(pwd)/secrets/live/" | ||
| echo -e "\nThere are 2 basic methods to create secrets:" | ||
| echo " [1] - Generate new secrets via a script" | ||
| echo -e " [2] - Copy secrets from a $(pwd)/secrets/template directory into $(pwd)/secrets/live/ and then modify them\n" | ||
| echo -n "Would you like to generate random secrets? Run a script to create secrets? [y/N] " | ||
| read ans | ||
| if [[ ${ans} == [yY] ]] ; then | ||
| docker run --rm -t \ | ||
| -v $(pwd)/secrets:/secrets \ | ||
| -v $(pwd)/scripts/generate-secrets.sh:/generate-secrets.sh \ | ||
| -w / \ | ||
| --entrypoint bash \ | ||
| ${REPOSITORY}/drupal:${TAG} -c "/generate-secrets.sh && chown -R `id -u`:`id -g` /secrets" | ||
| echo -e "\n${GREEN}Secrets generated.${RESET}" | ||
| else | ||
| echo "" | ||
| echo -n "Would you like to copy the default secrets? Run a script to copy secrets? [y/N] " && \ | ||
| read second_ans | ||
| if [[ ${second_ans:-N} == [yY] ]] ; then | ||
| echo -e "\nCopying secrets from $(pwd)/secrets/template/ to $(pwd)/secrets/live/\n" | ||
| echo -e "${GREEN}Suggestion${RESET}:\n It is much easier to modify these before you start isle than to try to figure out how to push them to the containers." | ||
| cp -n $(pwd)/secrets/template/* $(pwd)/secrets/live/ | ||
| echo -e "This is optional, but it is recommended to modify the secrets in $(pwd)/secrets/live/ before running on a production environment.\n\n" | ||
| echo -e "Would you like to ${RED}exit${RESET} this build process to change the default values of the secrets manually? [y/N] " | ||
| read exit_answer | ||
| if [[ ${exit_answer} == [yY] ]] ; then | ||
| echo -e "\n${RED}Exiting build${RESET}: Please modify the secrets in $(pwd)/secrets/live/ and then run ${BLUE}make up${RESET} command to continue the build process.\n\n\n\n${RED}Exiting build now!...${RESET}" | ||
| exit 1 | ||
| fi | ||
| fi | ||
| fi | ||
| fi | ||
|
|
||
| local secret_live=($(find $(pwd)/secrets/live/* -exec basename {} \;)) | ||
| for secret in "${secret_templates[@]}"; do | ||
| if [[ ! "${secret_live[@]}" =~ "${secret}" ]]; then | ||
| missing_secret_identified=true | ||
| break; | ||
| fi | ||
|
|
||
| if [[ $hash == "UNKNOWN" ]]; then | ||
| if [[ $(cat secrets/template/${secret}) == $(cat secrets/live/${secret}) ]]; then | ||
| # Ignore the config location directory. This won't pose a security risk. | ||
| if [[ ! "${secret}" = "DRUPAL_DEFAULT_CONFIGDIR" ]]; then | ||
| echo -e "${RED}Default Secret${RESET} ${BLUE}->${RESET} $(pwd)/secrets/live/${secret}" | ||
| FOUND_INSECURE_SECRETS=true | ||
| fi | ||
| fi | ||
| else | ||
| if [[ "$($hash $(pwd)/secrets/template/${secret}| awk '{print $1}')" == "$($hash $(pwd)/secrets/live/${secret}| awk '{print $1}')" ]]; then | ||
| # Ignore the config location directory. This won't pose a security risk. | ||
| if [[ ! "${secret}" = "DRUPAL_DEFAULT_CONFIGDIR" ]]; then | ||
| echo -e "${RED}Default Secret${RESET} ${BLUE}->${RESET} $(pwd)/secrets/live/${secret}" | ||
| FOUND_INSECURE_SECRETS=true | ||
| fi | ||
| fi | ||
| fi | ||
| done | ||
|
|
||
| if [ "${missing_secret_identified}" = true ]; then | ||
| echo -e "\n\nIdentified a few missing SECRETS.\n" | ||
| echo -e " Would you like to copy the missing secrets from $(pwd)/secrets/template/? [y/N] " | ||
| read thr_ans | ||
| if [[ ${thr_ans} == [yY] ]] ; then | ||
| echo "" | ||
| for secret in "${secret_templates[@]}"; do | ||
| if [[ ! "${secret_live[@]}" =~ "${secret}" ]]; then | ||
| echo "MISSING: $(pwd)/secrets/live/${secret}" | ||
| echo -e " Copying ${RED}${secret}${RESET} to $(pwd)/secrets/live/${GREEN}${secret}${RESET}\n" | ||
| cp -n $(pwd)/secrets/template/${secret} $(pwd)/secrets/live/${secret} | ||
| echo "" | ||
| fi | ||
| done | ||
| else | ||
| echo -e "\nPlease update the missing secrets before continuing.\n\n" | ||
| exit 1 | ||
| fi | ||
| fi | ||
|
|
||
| # Check if Salt matches the one in secrets/live/. | ||
| SALT=$(echo $(docker-compose exec drupal with-contenv bash -lc "cat web/sites/default/settings.php | grep hash_salt | grep '^\$settings' | cut -d\= -f2| cut -d\' -f2 | cut -f1 -d\"'\" | tr -d '\n' | cut -f1 -d\"%\"")) | ||
| SETTINGS_SALT=$(echo $(cat secrets/live/DRUPAL_DEFAULT_SALT | tr -d '\n' | cut -f1 -d"%")) | ||
| if [[ $(echo "${SALT}") != $(echo "${SETTINGS_SALT}") ]]; then | ||
| echo "${SALT} ${SETTINGS_SALT} Updates to the salt are not automatically added to web/sites/default/settings.php file. Please make this change manually and then run the same ${BLUE}make down && make up${RESET} command again." | ||
| fi | ||
| } | ||
|
|
||
| # Just incase the wishes to automate generation of secrets. | ||
| if [[ $1 == 'yes' ]]; then | ||
| docker run --rm -t \ | ||
| -v $(pwd)/secrets:/secrets \ | ||
| -v $(pwd)/scripts/generate-secrets.sh:/generate-secrets.sh \ | ||
| -w / \ | ||
| --entrypoint bash \ | ||
| ${REPOSITORY}/drupal:${TAG} -c "/generate-secrets.sh && chown -R `id -u`:`id -g` /secrets" | ||
| echo -e "\n${GREEN}Secrets generated.${RESET}" | ||
| fi | ||
|
|
||
| main | ||
| print_security_warning | ||
| echo -e "\nCheck secrets is ${GREEN}done${RESET}.\n\n" |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Might want to also mention that they should be sure to set
to the value of
DRUPAL_DEFAULT_SALTto $settings['hash_salt'] in codebase/web/sites/default/settings.php and the value ofDRUPAL_DEFAULT_DB_PASSWORDto the value$databases['default']['default']['password']in the same file (it's actually in the file twice??)Or maybe we should use the file path option instead of parsing it into the file?
$settings['hash_salt'] = file_get_contents('/home/example/salt.txt');There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Also will a make up update passwords if they are created after a
make localormake up?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I only see $databases['default']['default']['password'] once in my install.
I just pushed a warning to the user to manually update their settings.php file when it notices a difference between the
secrets/live/DRUPAL_DEFAULT_SALTandweb/sites/default/settings.phpfile. I felt like it might take too long to try to automatically do this for the user and restart their container because this script is running on the local and we'd need to account for Mac command discrepancies.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It looks like it was my older version had some extra things in there