Initial work to allow password protected PEM files #174
Conversation
Handle multiple password prompts Had to put this before go-routines so we could hang on to STDIN Adding gopass to vendoring Tests for new ssl library stuff
| @@ -112,7 +131,7 @@ func standardHttp(discovery bool) { | |||
| log.Fatale(err) | |||
| } | |||
| tlsConfig.InsecureSkipVerify = config.Config.SSLSkipVerify | |||
| if err = ssl.AppendKeyPair(tlsConfig, config.Config.SSLCertFile, config.Config.SSLPrivateKeyFile); err != nil { | |||
| if err = ssl.AppendKeyPairWithPassword(tlsConfig, config.Config.SSLCertFile, config.Config.SSLPrivateKeyFile, sslPEMPassword); err != nil { | |||
There was a problem hiding this comment.
I can wrap this in an 'if' that checks to see if we have a password, or leave it as is. The function doesn't try to decrypt a non-encrypted cert, so it's mostly a no-op, but the naming is somewhat misleading. Interested in other opinions here.
There was a problem hiding this comment.
I'm good with this. @djuntgen, any concerns?
|
@grierj Does |
|
I'm not sure I'm keen on orchestrator prompting for password upon execution. It is being built for automation. In my environments it is used within cronjobs and chatops. @djuntgen what are the alternatives to prompting? |
|
It only prompts if your private keys are password protected, keys without passwords won't prompt. And then it does this at start-up time only (before all the go routines are spawned). Alternatives could be password files, but they have similar issues to not having the key password protected. |
|
@djuntgen Yes, it looks at the configured SSH keys (orchestrator and orchestrator-agent) and if they are found to be encrypted, there will be a stdin style password prompt to ask for them. Note: This doesn't work with the mutual TLS certificates for orchestrator to mysql communication, but it could if there was a desire to. |
|
@grierj shall I merge at this time? |
|
@grierj @shlomi-noach - i'm good! |
|
@shlomi-noach as long as you're fine with the initial prompting, it's good to merge. |
Handle multiple password prompts
Had to put this before go-routines so we could hang on to STDIN
Adding gopass to vendoring
Tests for new ssl library stuff
This should solve #157