search

rancher / k3os

Purpose-built OS for Kubernetes, fully managed by Kubernetes.
https://k3os.io
Apache License 2.0
3.5k stars 402 forks source link

Cluster tokens with spaces not handled properly #708

Open justledbetter opened 3 years ago

justledbetter commented 3 years ago

Version (k3OS / kernel)

k3os version v0.20.6-k3s1r0 5.4.0-72-generic #80 SMP Tue May 4 19:31:44 UTC 2021

Architecture

x86_64

Describe the bug When specifying a passphrase as the k3s service token (containing spaces), the token is not properly quoted in the startup configuration, causing a heavily truncated token to be used by the cluster.

k3os-93130 [~]$ sudo cat /etc/rancher/k3s/k3s-service.env 
K3S_CLUSTER_SECRET=this is a silly little sentence of zest and fun

To Reproduce

this is my cluster secret

Expected behavior

As this is a development environment, I wasn't expecting to provide a super secure token; but I wanted it to be more secure than a semi-random string of 15 characters. And without copy/paste, wanted something that was relatively easy to type.

Actual behavior

The following error messages appear in the k3os startup logs:

/lib/rc/sh/gendepends.sh: /etc/rancher/k3s/k3s-service.env: line 1: is: not found

Note that this causes the environment to run with the actual token this, which is critically insecure.

k3os-21591 [~]$ sudo cat /etc/rancher/k3s/k3s-service.env 
K3S_CLUSTER_SECRET=this is my cluster secret

Additional context

I'm not sure if anyone ever expected to see spaces in k3s service tokens, but didn't find any documentation to suggest that they're forbidden either here or in the k3s repo.

https://resources.infosecinstitute.com/topic/password-security-complexity-vs-length

I believe this behavior was caused by Issue #590.

This is roughly the line that is causing the problem: https://github.com/dweomer/k3os/blob/master/pkg/cc/funcs.go#L132

A proper fix might be to change any line that creates an environment variable within a shell script to read:

vars = append(vars, fmt.Sprintf("ENV_VARNAME=%s", strconv.Quote(value))
dweomer commented 3 years ago

Was wondering how long this would take to break someone. Thanks for reporting and doing the investigation!

dweomer commented 3 years ago

As mentioned in #590 we are relying on the k3s install.sh capture of k3s-related environment variables and that processing does not currently support whitespace nor shell-relevant special characters (such as !) in tokens. Until a fix lands with k3s the work-around will be to use dashes as separators instead of spaces.