3e6f3f58a9
Add comprehensive encrypted environment variable system with AES-256 encryption. Security Features: - AES-256-CBC encryption with PBKDF2 (100k iterations) - Root-only encryption key (/root/.tilbudgivern-secure/) - Encrypted .env.enc files safe to commit to git - Plaintext .env files only exist at runtime - Auto-cleanup on shutdown Components: - setup-encrypted-env.sh: Encrypt .env → .env.enc - decrypt-env.sh: Decrypt .env.enc → .env - start-secure.sh: Decrypt + start application - test-encryption.sh: Test encryption/decryption - tilbudgivern-secure.service: Systemd service Documentation: - ENCRYPTED_ENV_README.md: Overview and quick start - ENCRYPTED_ENV_QUICKSTART.md: Quick reference guide - docs/ENCRYPTED_ENV_SECURITY.md: Complete security guide Threat Model: ✅ User account compromise: Credentials safe ✅ Git repository leak: Only encrypted files exposed ✅ File system read: Encrypted files useless ❌ Root compromise: Defense in depth This ensures attackers need root access to decrypt credentials.
142 lines
3.6 KiB
Bash
Executable File
142 lines
3.6 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
################################################################################
|
|
# Test Encrypted Environment Setup
|
|
#
|
|
# This script tests the encryption/decryption workflow
|
|
################################################################################
|
|
|
|
set -e
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
|
|
GREEN='\033[0;32m'
|
|
RED='\033[0;31m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m'
|
|
|
|
echo "======================================"
|
|
echo "Encrypted Environment Test"
|
|
echo "======================================"
|
|
echo ""
|
|
|
|
# Create test .env files
|
|
echo -e "${YELLOW}Step 1: Creating test .env files...${NC}"
|
|
mkdir -p "$PROJECT_ROOT/test-env"
|
|
|
|
cat > "$PROJECT_ROOT/test-env/.env" << 'EOF'
|
|
# Test Environment File
|
|
DB_PASSWORD=TestPassword123!
|
|
API_KEY=sk-test-1234567890abcdef
|
|
SESSION_SECRET=test-secret-minimum-32-characters-long
|
|
AUTH_PASSWORD=test-auth-pass
|
|
EOF
|
|
|
|
echo "✓ Created test .env file"
|
|
cat "$PROJECT_ROOT/test-env/.env"
|
|
echo ""
|
|
|
|
# Test encryption
|
|
echo -e "${YELLOW}Step 2: Testing encryption...${NC}"
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo "This test requires root access for encryption"
|
|
echo "Running: sudo..."
|
|
fi
|
|
|
|
sudo bash << 'SUDO_SCRIPT'
|
|
set -e
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_ROOT="/mnt/HC_Volume_103713257/tilbudgivern"
|
|
SECURE_DIR="/root/.tilbudgivern-secure"
|
|
KEY_FILE="$SECURE_DIR/encryption.key"
|
|
|
|
# Create secure directory and key if needed
|
|
mkdir -p "$SECURE_DIR"
|
|
chmod 700 "$SECURE_DIR"
|
|
|
|
if [[ ! -f "$KEY_FILE" ]]; then
|
|
openssl rand -base64 32 > "$KEY_FILE"
|
|
chmod 600 "$KEY_FILE"
|
|
echo "✓ Generated encryption key"
|
|
fi
|
|
|
|
# Encrypt test file
|
|
openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 \
|
|
-in "$PROJECT_ROOT/test-env/.env" \
|
|
-out "$PROJECT_ROOT/test-env/.env.enc" \
|
|
-pass file:"$KEY_FILE"
|
|
|
|
chmod 600 "$PROJECT_ROOT/test-env/.env.enc"
|
|
echo "✓ Encrypted test file"
|
|
SUDO_SCRIPT
|
|
|
|
ls -la "$PROJECT_ROOT/test-env/.env.enc"
|
|
echo ""
|
|
|
|
# Remove original
|
|
echo -e "${YELLOW}Step 3: Removing plaintext file...${NC}"
|
|
rm "$PROJECT_ROOT/test-env/.env"
|
|
echo "✓ Removed plaintext .env"
|
|
echo ""
|
|
|
|
# Test decryption
|
|
echo -e "${YELLOW}Step 4: Testing decryption...${NC}"
|
|
sudo bash << 'SUDO_SCRIPT'
|
|
set -e
|
|
|
|
PROJECT_ROOT="/mnt/HC_Volume_103713257/tilbudgivern"
|
|
KEY_FILE="/root/.tilbudgivern-secure/encryption.key"
|
|
|
|
# Decrypt
|
|
openssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 \
|
|
-in "$PROJECT_ROOT/test-env/.env.enc" \
|
|
-out "$PROJECT_ROOT/test-env/.env" \
|
|
-pass file:"$KEY_FILE"
|
|
|
|
chmod 600 "$PROJECT_ROOT/test-env/.env"
|
|
chown alex:alex "$PROJECT_ROOT/test-env/.env"
|
|
echo "✓ Decrypted test file"
|
|
SUDO_SCRIPT
|
|
|
|
echo "Decrypted content:"
|
|
cat "$PROJECT_ROOT/test-env/.env"
|
|
echo ""
|
|
|
|
# Verify content
|
|
echo -e "${YELLOW}Step 5: Verifying content...${NC}"
|
|
if grep -q "TestPassword123!" "$PROJECT_ROOT/test-env/.env"; then
|
|
echo -e "${GREEN}✓ Password verified${NC}"
|
|
else
|
|
echo -e "${RED}✗ Password mismatch${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
if grep -q "sk-test-1234567890abcdef" "$PROJECT_ROOT/test-env/.env"; then
|
|
echo -e "${GREEN}✓ API key verified${NC}"
|
|
else
|
|
echo -e "${RED}✗ API key mismatch${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
echo ""
|
|
|
|
# Cleanup
|
|
echo -e "${YELLOW}Step 6: Cleanup...${NC}"
|
|
rm -f "$PROJECT_ROOT/test-env/.env"
|
|
rm -f "$PROJECT_ROOT/test-env/.env.enc"
|
|
rmdir "$PROJECT_ROOT/test-env" 2>/dev/null || true
|
|
echo "✓ Cleaned up test files"
|
|
echo ""
|
|
|
|
echo "======================================"
|
|
echo -e "${GREEN}✅ All tests passed!${NC}"
|
|
echo "======================================"
|
|
echo ""
|
|
echo "The encryption/decryption system is working correctly."
|
|
echo "You can now use:"
|
|
echo " - sudo ./scripts/setup-encrypted-env.sh"
|
|
echo " - sudo ./scripts/decrypt-env.sh"
|
|
echo ""
|