manifoldco / manifoldco/torus-cli
Gatekeeper: Bootstrap over SSL
Open
Nobody has claimed this yet.
help wanted
- Dominant language
- Go
- Stars
- 603
- Forks
- 30
- PR merge metrics
- No merged PRs in 30d
Description
Currently, all bootstrapping communication is done over a normal HTTP connection, however machine token ID and secret are shared back to the machine that is being bootstrapped. An evesdropper in your network could MITM to retrieve this information, and once the machine was given access, a malicious user could act as that machine.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the Torus CLI bootstrapping communication and locating where the machine token ID and secret are sent over HTTP. Define the SSL-based transport and verify that bootstrapping no longer exposes those credentials to a network eavesdropper.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100