Disclosure of sensitive credentials and configuration in containerized deployments - ownCloud (owncloud.com)

submitted 9 months ago by [email protected] to c/[email protected]

29 comments fedilink hide all child comments

I haven't seen this posted yet here, but anybody self-hosting OwnCloud in a containerized environment may be exposing sensitive environment variables to the public internet. There may be other implications as well.

you are viewing a single comment's thread
view the rest of the comments

[-] [email protected] 4 points 9 months ago

I'm using Kubernetes and many of the apps that I use require environment variables to pass secrets. Another option is the pod definition, which is viewable by anybody with read privileges to K8s. Secrets are great to secure it on the K8s side, but the application either needs to read the secret from a file or you build your own helm chart with a shell front end to create app config files on the fly. I'm sure there are other options, but there's no "one size fits all" type solution.

The real issue here is that the app is happy to expose it's environment variables with no consideration given to the fact that it may contain data that can be misused by bad actors. It's security 101 to not expose any more than the user needs to see which is why stack dumps are disabled on production implementations.

[-] [email protected] 5 points 9 months ago

The problem is in fact in the applications. If these support loading secrets from a file, then the problem does not exist. Even with the weak secrets implementation in kubernetes, it is still far better than ENV variables.

The disappointing thing is that in many "selfhost" apps, often the credentials to specify are either db credentials or some sort of initial password, which could totally be read from file or be generated randomly at first run.

I agree that the issue is information disclosure, but the problem is that ENV variables are stored in memory, are accessible to many other processes on the same system, etc. They are just not a good way to store sensitive information.

this post was submitted on 01 Dec 2023

81 points (98.8% liked)

Selfhosted

39239 readers

270 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

[email protected]