Prevent writing plaintext admin key and password to stdout (#290)

* Prevent writing plaintext admin key and password to stdout

Author: jeremiah-RENISAC

core/files/configure_misp.sh

@@ -350,7 +350,11 @@ init_user() {
     fi
 
     if [ -n "$ADMIN_KEY" ]; then
-        echo "... setting admin key to '${ADMIN_KEY}'"
+        if [ "$DISABLE_PRINTING_PLAINTEXT_CREDENTIALS" == "true" ]; then
+            echo "... setting admin key from environment variable"
+        else
+            echo "... setting admin key to '${ADMIN_KEY}'"
+        fi
         CHANGE_CMD=(sudo -u www-data /var/www/MISP/app/Console/cake User change_authkey 1 "${ADMIN_KEY}")
     elif [ -z "$ADMIN_KEY" ] && [ "$AUTOGEN_ADMIN_KEY" == "true" ]; then
         echo "... regenerating admin key (set \$ADMIN_KEY if you want it to change)"
@@ -361,11 +365,19 @@ init_user() {
 
     if [[ -v CHANGE_CMD[@] ]]; then
         ADMIN_KEY=$("${CHANGE_CMD[@]}" | awk 'END {print $NF; exit}')
-        echo "... admin user key set to '${ADMIN_KEY}'"
+        if [ "$DISABLE_PRINTING_PLAINTEXT_CREDENTIALS" == "true" ]; then
+            echo "... admin user key set"
+        else
+            echo "... admin user key set to '${ADMIN_KEY}'"
+        fi
     fi
 
     if [ ! -z "$ADMIN_PASSWORD" ]; then
-        echo "... setting admin password to '${ADMIN_PASSWORD}'"
+        if [ "$DISABLE_PRINTING_PLAINTEXT_CREDENTIALS" == "true" ]; then
+            echo "... setting admin password from environment variable"
+        else
+            echo "... setting admin password to '${ADMIN_PASSWORD}'"
+        fi
         PASSWORD_POLICY=$(sudo -u www-data /var/www/MISP/app/Console/cake Admin getSetting "Security.password_policy_complexity" | jq ".value" -r)
         PASSWORD_LENGTH=$(sudo -u www-data /var/www/MISP/app/Console/cake Admin getSetting "Security.password_policy_length" | jq ".value" -r)
         sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "Security.password_policy_length" 1

docker-compose.yml

@@ -112,6 +112,7 @@ services:
       - "ENABLE_BACKGROUND_UPDATES=${ENABLE_BACKGROUND_UPDATES}"
       - "ENCRYPTION_KEY=${ENCRYPTION_KEY}"
       - "DISABLE_CA_REFRESH=${DISABLE_CA_REFRESH}"
+      - "DISABLE_PRINTING_PLAINTEXT_CREDENTIALS=${DISABLE_PRINTING_PLAINTEXT_CREDENTIALS}"
       # standard settings
       - "ADMIN_EMAIL=${ADMIN_EMAIL}"
       - "ADMIN_PASSWORD=${ADMIN_PASSWORD}"

template.env

@@ -44,6 +44,9 @@ ADMIN_ORG_UUID=
 ADMIN_KEY=
 # defaults to MISP's default (admin)
 ADMIN_PASSWORD=
+# Prevent MISP Initialization from writing ADMIN_KEY and ADMIN_PASSWORD in plaintext
+# Recommend uncommenting / setting to true in production or kubernetes environments where output is logged.
+#DISABLE_PRINTING_PLAINTEXT_CREDENTIALS=true
 # defaults to 'passphrase'
 GPG_PASSPHRASE=
 # defaults to 1 (the admin user)