guardicore / guardicore/monkey

OTP override for development only

Open
#3,080 0 comments 0 reactions 0 assignees View on GitHub
Complexity: High Impact: Medium Security
Dominant language
Python
Stars
7.1k
Forks
830
PR merge metrics
No merged PRs in 30d

Description

## Description

If the environment variable `INFECTION_MONKEY_OTP_OVERRIDE` exists, we want to skip enforcement of OTP/Authentication for the `Agent` role. This will keep development (running from source) simpler and easier for developers.

Ideally, this override feature would not even be included in release binaries.

## Tasks
- [ ] Define an environment variable with a reusable "OTP"
- [ ] If the environment variable exists **on island startup**
- [ ] Force the user to confirm [y/n] that they still want to start the Island
- [ ] Pass the "override OTP" to the OTP endpoint/service
- [ ] Implement logic in the OTP endpoint/service to accept the override OTP
- [ ] Log a warning every time we accept the override OTP
- [ ] Log a warning when this component is constructed
- [ ] Try to find a way (similar to `#IFNDEF`) to exclude OTP override from release binaries

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.