search

jasonish / evebox

Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search
https://evebox.org/
MIT License
417 stars 67 forks source link

How to encrypt password #201

Closed ngms17 closed 1 year ago

ngms17 commented 2 years ago

How can i cypher the password field to avoid being in clear text?

database: elasticsearch: username: username password: password

jasonish commented 2 years ago

This is a problem I'm not sure how to solve best. If it was encrypted, you would have to enter a password every time you started EveBox which is not ideal. I think the standard way for client-side applications to do this is for configuration files that you limit the permissions on. Postfix is like this for configuration credentials against your relay SMTP servers. I suppose I could add an option where credentials were looked for in another file like Postfix does, but you'd still be relying on the filesystem to protect your credentials.

Another option is to allow the username and password to be set as an environment variable (this might work, I need to test), then you could integrate with tools like Hashicorp Vault.

jasonish commented 1 year ago

Closing as out of scope. Filebeat, and lots of other tools have this same issue and generally file system permissions are the way.