My Website

Storing Secrets

Copied from https://9p.io/wiki/plan9/using_aescbc_to_store_factotum_keys/index.html

GETTING THE KEYS The easiest way to get the right options for the keys is to let factotum do it for you. Authenticate to the services you want the keys to be saved for and read factotum’s control file.

% cat /mnt/factotum/ctl
key proto=p9sk1 dom=outside.plan9.bell-labs.com user=rsc !password?
% 

SAVING THE KEYS First, your secrets file must be initialised.

% echo test | auth/aescbc -e > $home/lib/fact.keys
aescbc key:

Change the permissions on the file so that only you can read it.

% chmod 600 $home/lib/fact.keys

Add the keys to the secrets file.

% ipso -a $home/lib/fact.keys

  Warning: The editor will display the secret contents of
  your aescbc files in the clear.

aescbc password:
aescbc key:

Replace ‘test’ with the keys, replacing each instance ‘!password?’ to ‘!password=secret’ where ‘secret’ is the password for the key.

POPULATING FACTOTUM AT STARTUP Instead of manually running the command to populate factotum, you can have it done in your profile

# Add some keys to factotum
if(test -f $home/lib/fact.keys)
   auth/aescbc -d < $home/lib/fact.keys | read -m > /mnt/factotum/ctl