search

cloudcaptainsh / cloudcaptain

Issue Tracker for CloudCaptain
13 stars 3 forks source link

Obfuscate secure environment variables (like RDS credentials) in boot logs #142

Open aweigold opened 7 years ago

aweigold commented 7 years ago

Noticed boxfuse run shows the logging from the server, which is really nice... but realized that there may be many people who are doing this on a publicly viewable build system, which would allow anybody to see the database credentials from the command line. That should probably be scrubbed out from the run command or have a flag to allow it to be scrubbed out.

axelfontaine commented 7 years ago

To disable the display of logs altogether while new instances come up you can use -logs.auto=false (see https://boxfuse.com/docs/commandline/run#logs.auto)

To disable the instance boot logs which contain the environment variables you can use -logs.boot=false (see https://boxfuse.com/docs/commandline/run#logs.boot)

Scrubbing the RDS password by default could be a good thing though. Renaming issue title to reflect this.