-
Notifications
You must be signed in to change notification settings - Fork 53
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1969 from yunkon-kim/250210-21
Improve API password protection
- Loading branch information
Showing
11 changed files
with
169 additions
and
72 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,6 +4,7 @@ | |
| *.dll | ||
| *.so | ||
| *.dylib | ||
| cmd/bcrypt/bcrypt | ||
|
|
||
| # Keys | ||
| *.pem | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| # TB API Password Configuration Guide | ||
|
|
||
| ## Generating Password Hash | ||
|
|
||
| 1. From the CB-Tumblebug root directory, generate a bcrypt hash of your password using: | ||
|
|
||
| ```shell | ||
| make bcrypt PASSWORD=yourpassword | ||
| ``` | ||
|
|
||
| 2. Copy the generated hash value. | ||
|
|
||
| ## Configuring the Password | ||
|
|
||
| ### Using Docker Compose | ||
|
|
||
| 1. Open `docker-compose.yaml` and update the `TB_API_PASSWORD` environment variable with ($$): | ||
| ```yaml | ||
| environment: | ||
| - TB_API_PASSWORD=$$2a$$10$$4PKzCuJ6fPYsbCF.HR//ieLjaCzBAdwORchx62F2JRXQsuR3d9T0q | ||
| ``` | ||
| ### Using Environment File | ||
| 1. If you're using `setup.env`, update the password hash: | ||
| ```shell | ||
| TB_API_PASSWORD='$2a$10$4PKzCuJ6fPYsbCF.HR//ieLjaCzBAdwORchx62F2JRXQsuR3d9T0q' | ||
| ``` | ||
|
|
||
| ### Using Dockerfile | ||
|
|
||
| 1. If you're building directly with Dockerfile, update the environment variable with (' '): | ||
| ```dockerfile | ||
| ENV TB_API_PASSWORD='$2a$10$4PKzCuJ6fPYsbCF.HR//ieLjaCzBAdwORchx62F2JRXQsuR3d9T0q' | ||
| ``` | ||
|
|
||
| ## Notes | ||
|
|
||
| - Always keep your password hash secure | ||
| - Never commit the actual password or hash to version control | ||
| - The hash should be properly escaped if it contains special characters |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "bufio" | ||
| "flag" | ||
| "fmt" | ||
| "os" | ||
| "strings" | ||
|
|
||
| "golang.org/x/crypto/bcrypt" | ||
| ) | ||
|
|
||
| func hashPassword(password string) (string, error) { | ||
| bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost) | ||
| return string(bytes), err | ||
| } | ||
|
|
||
| func verifyPassword(password, hash string) bool { | ||
| err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) | ||
| return err == nil | ||
| } | ||
|
|
||
| func main() { | ||
| verify := flag.Bool("verify", false, "Verify a password against a hash") | ||
| flag.Parse() | ||
|
|
||
| reader := bufio.NewReader(os.Stdin) | ||
|
|
||
| if *verify { | ||
| fmt.Print("Enter hash: ") | ||
| hash, _ := reader.ReadString('\n') | ||
| hash = strings.TrimSpace(hash) | ||
|
|
||
| fmt.Print("Enter password to verify: ") | ||
| password, _ := reader.ReadString('\n') | ||
| password = strings.TrimSpace(password) | ||
|
|
||
| if verifyPassword(password, hash) { | ||
| fmt.Println("Password is valid!") | ||
| } else { | ||
| fmt.Println("Password is invalid!") | ||
| } | ||
| return | ||
| } | ||
|
|
||
| fmt.Print("Enter password to hash: ") | ||
| password, _ := reader.ReadString('\n') | ||
| password = strings.TrimSpace(password) | ||
|
|
||
| hash, err := hashPassword(password) | ||
| if err != nil { | ||
| fmt.Printf("Error hashing password: %v\n", err) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| fmt.Printf("Bcrypt hash: %s\n", hash) | ||
| fmt.Printf(" - For docker-compose.yaml and .env (with $$): %s\n", strings.ReplaceAll(hash, "$", "$$")) | ||
| fmt.Printf(" - For Dockerfile or environment variables (with ' '): '%s'\n", hash) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.