{"action":"closed","issue":{"url":"https://api.github.com/repos/overview/overview-server/issues/284","labels_url":"https://api.github.com/repos/overview/overview-server/issues/284/labels{/name}","comments_url":"https://api.github.com/repos/overview/overview-server/issues/284/comments","events_url":"https://api.github.com/repos/overview/overview-server/issues/284/events","html_url":"https://github.com/overview/overview-server/issues/284","id":10210846,"number":284,"title":"Remove secrets from production.web and production.worker instances","user":{"login":"adamhooper","id":10812,"avatar_url":"https://avatars.githubusercontent.com/u/10812?v=3","gravatar_id":"","url":"https://api.github.com/users/adamhooper","html_url":"https://github.com/adamhooper","followers_url":"https://api.github.com/users/adamhooper/followers","following_url":"https://api.github.com/users/adamhooper/following{/other_user}","gists_url":"https://api.github.com/users/adamhooper/gists{/gist_id}","starred_url":"https://api.github.com/users/adamhooper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adamhooper/subscriptions","organizations_url":"https://api.github.com/users/adamhooper/orgs","repos_url":"https://api.github.com/users/adamhooper/repos","events_url":"https://api.github.com/users/adamhooper/events{/privacy}","received_events_url":"https://api.github.com/users/adamhooper/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/overview/overview-server/labels/security","name":"security","color":"e10c02"}],"state":"closed","locked":false,"assignee":{"login":"adamhooper","id":10812,"avatar_url":"https://avatars.githubusercontent.com/u/10812?v=3","gravatar_id":"","url":"https://api.github.com/users/adamhooper","html_url":"https://github.com/adamhooper","followers_url":"https://api.github.com/users/adamhooper/followers","following_url":"https://api.github.com/users/adamhooper/following{/other_user}","gists_url":"https://api.github.com/users/adamhooper/gists{/gist_id}","starred_url":"https://api.github.com/users/adamhooper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adamhooper/subscriptions","organizations_url":"https://api.github.com/users/adamhooper/orgs","repos_url":"https://api.github.com/users/adamhooper/repos","events_url":"https://api.github.com/users/adamhooper/events{/privacy}","received_events_url":"https://api.github.com/users/adamhooper/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2013-01-22T21:47:53Z","updated_at":"2015-02-25T19:48:08Z","closed_at":"2015-02-25T19:48:08Z","body":"Right now, production.web and production.worker instances store unencrypted keys (application-secret, Postgres password, SSL certificate and private key). The danger is: if somebody roots the instance, he or she will have quick access to our database and SSL keys.\r\n\r\nWe can mitigate this danger: instead of making the machines self-sufficient, we can ensure that only `overview-manage` can start them. This is done by specifying an environment variable in the \"start\" command.\r\n\r\nWe should only do this once we're comfortable with `overview-manage`, as we'd be tied to it.\r\n\r\nAlso: once this is done, be sure to erase and zero out old config files from /opt/overview/managed-code/config, as they'll contain the keys.\r\n\r\n(An industrious attacker would be able to read the values from memory. We can mitigate this somewhat by using a separate username for each process; that way an attacker who gains access through haproxy won't get our application-secret, and vice-versa.)"}}