sudo chef-server-ctl user-create shouldn't show the key in the terminal
Nobody has claimed this yet.
- Dominant language
- Erlang
- Stars
- 303
- Forks
- 211
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 5
Description
Chef Server Version
13.0
Platform Details
Ubuntu 18.04
Configuration
Standalone
Scenario:
When the user runs 'sudo chef-server-ctl user-create ...' it currently creates the private key in the terminal. This means the private key is available in terminal scrollback which can be infinite for a lot of users. This seems like a bad security setup. We should just write the key to disk and then tell the user where to find it. That's how a lot of similar CLI tools handle key generation so they don't save secrets into insecure mediums.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the implementation of sudo chef-server-ctl user-create ... and trace how the private key is currently emitted. Done means the key is written to disk and the command tells the user where to find it, without displaying the key in terminal output.
Written by the indexing model from the issue text.
Assessment
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100