Maxoq
Well-known member
- Joined
- Feb 25, 2015
- Messages
- 549
- Points
- 28
Every box I run ends up with a handful of scripts needing a database password or an API token, and I have never been happy with where those end up. Config file inside the project, env file next to it, a file in root's home read by cron. All of them work, and all of them have a way of ending up somewhere I did not intend.
The one that caught me was backups. A config file with live database credentials sat outside the document root but inside the folder the backup job archived, and that archive went to object storage with wider access than the server itself had. Nothing was breached as far as I can tell, but those credentials had been sitting somewhere less protected than the machine they belonged to for months, and I only noticed while looking for something else.
Since then anything holding a secret lives outside the tree that gets archived, and the backup job excludes it by name rather than by pattern, because a pattern is one typo away from including it again. Mode 600, owned by the user that runs the job, and never edited on the live box.
What I have not solved is rotation. Changing a database password means finding every place it was copied to, and I only reliably know about the copies I made myself. Does anyone here actually rotate credentials on a small fleet on a schedule, or is it something that only happens after something has already gone wrong?
The one that caught me was backups. A config file with live database credentials sat outside the document root but inside the folder the backup job archived, and that archive went to object storage with wider access than the server itself had. Nothing was breached as far as I can tell, but those credentials had been sitting somewhere less protected than the machine they belonged to for months, and I only noticed while looking for something else.
Since then anything holding a secret lives outside the tree that gets archived, and the backup job excludes it by name rather than by pattern, because a pattern is one typo away from including it again. Mode 600, owned by the user that runs the job, and never edited on the live box.
What I have not solved is rotation. Changing a database password means finding every place it was copied to, and I only reliably know about the copies I made myself. Does anyone here actually rotate credentials on a small fleet on a schedule, or is it something that only happens after something has already gone wrong?
