Change go client, so apitoken can be set by environment entry instead argument

mercedes-benz / sechub

SecHub provides a central API to test software with different security tools.

https://mercedes-benz.github.io/sechub/

MIT License

263 stars 63 forks source link

Change go client, so apitoken can be set by environment entry instead argument #36

Closed de-jcup closed 4 years ago

de-jcup commented 5 years ago

Currently we got same situation for go client as for admin ui, see #8 : Everybody able to see processes on server side does also see api token used by calling sechub client.

SECHUB_APITOKEN environment shall be an addition to existing code. It shall be downward compatible. But a warning should be printed out when user is using argument instead of env entry.

de-jcup commented 5 years ago

Obsolete, because somebody having access to process list of another user has normally admin rights. Having admin rights you can do - at least on linux:

sudo cat /proc/$PID/environ

should be possible at windows as well, so makes no difference.

ghost commented 4 years ago

I would like to reopen this issue as the closing reason is not correct:

As an unprivileged user, I can execute ps aux on a linux server and see all processes of all users, even root.
But as an unprivileged user, I can not read the file /proc/$PID/environ of a process of another user: The file is owned by the user that has started the process and the file permissions allow only read access by the owner of the file.
It is correct, that as admin/root I can access the environ file for every process - but I think there is no way of hiding an API key for admins.

Therefore it would be a security enhancement to store the API token in an environment variable instead of giving it to the SecHub client as a command line parameter, as at least non-admin users would not be able to access the API token.

de-jcup commented 4 years ago

Andreas thank you ! You are absolutely right... will reopen issue and integrate into next release.

sven-dmlr commented 4 years ago

Created branch feature-36-api-token-as-env-variable

added possibilty to pass SecHub api token as environment variable SECHUB_APITOKEN
Additionally added a warning message when using -apitoken instead of the environment variable.
added possibilty to pass SecHub UserID as environment variable SECHUB_USERID
added possibilty to pass SecHub Server String as environment variable SECHUB_SERVER