3

I am very new to and trying to secure passwords using databags. Unfortunately, I tried in different ways but unable to succeed. I followed different tutorials first and second. I understood only two steps but later on I was unable to move forward.

  1. I created secret key using openssl
  2. In link1 step 2 says knife data bag create passwords mysql --secret-file /tmp/my_data_bag_key but I don't know where it is creating the databag.

Can some one guide me from step two? I am trying to secure my database password. I got stuck after creating secret file.

Improve this question
1
  • 1
    Take the tour at learn.chef.io that sounds like a basis misconception
    – Tensibai
    May 11, 2017 at 12:00

3 Answers 3

Reset to default
2

I'm using the following ruby script to encrypt/decrypt chef data bags locally: https://gist.github.com/anonymous/4923ebeee53fe4d43a1cfb70a2abaadd

to encrypt:

ruby encrypt.rb PATH_TO_SECRET_FILE < UNECRYPTED_DATA_BAG.json > ENCRYPTED_DATA_BAG.json

and to decrypt:

ruby decrypt.rb PATH_TO_SECRET_FILE < ENCRYPTED_DATA_BAG.json > DECRYPTED_DATA_BAG.json

Improve this answer
5
  • 1
    What the interest over knife built in commands ?
    – Tensibai
    May 11, 2017 at 12:43
  • yes I do have a file encrypt.rb file. if I encrypt it above procedure don't I need a secret file to decrypt it.@eyalzek
    – Sam
    May 11, 2017 at 17:45
  • @Tensibai AFAIK knife commands are only relevant when you have a chef server and not for encrypting/decrypting JSON files locally (which is what I understood OP is interested in).
    – eyalzek
    May 13, 2017 at 18:27
  • @Sam you need to generate the secret file, in the 2nd tutorial you linked to this is explained in the first paragraph using openssl: Create a random encryption key: openssl rand -base64 512 | tr -d '\r\n' > secret_key
    – eyalzek
    May 13, 2017 at 18:29
  • Since chef 12.18 (I think) you can use knife-zero to build on disk databags. But I misunderstood the goal of your script indeed, sorry for that
    – Tensibai
    May 13, 2017 at 18:29
2

You can create Chef data bags in two ways - by loading it from a json file on your disk, or by creating a new data bag which you then write content into (the two commands in the doc).

Encrypted data bags are stored on the server, and anyone who wants to read them (a workstation or node) needs to download and decrypt it with the secret key that you pass directly or from a file (see the command flags here).

Once you have stored your content (your secret key from openssl) in data bags, you can access them in recipes with data_bag_item(bag_name, item, secret) (again, see the docs for sample code).

Hope this helps!

Improve this answer
4
  • The data_bag_item in recipes DSL is the prefered way, it works with or without encryption, where your direct class access will fail on a clear text data bag (a pain to test then)
    – Tensibai
    May 16, 2017 at 11:25
  • @Tensibai True, but EncryptedDataBagItem will work because OP specified storing secrets, and that has to be encrypted.
    – grumpyops
    May 16, 2017 at 12:09
  • 1
    It is just code smell to call a class instead of using its DSL helper. I assume you don't write recipes with Chef::Resource::File.new('whatever') do |fres| but instead you do file 'whatever' do... that's the same thing here.
    – Tensibai
    May 16, 2017 at 12:15
  • 1
    @Tensibai thanks for that, TIL. I've updated the answer, you learn something new every day :D
    – grumpyops
    May 16, 2017 at 13:09
1

A data bag is stored on the chef server itself. My chef days are behind me, but you should be able to enter the data bag content either at the create step or the edit one.

For the step 2, just execute the command that you copied:

knife data bag create passwords mysql --secret-file /tmp/my_data_bag_key
Improve this answer
3
  • Thanks, I would like to ask is there any way that I can create databag independent to chef server. I mean creating databag locally @Michael
    – Sam
    May 10, 2017 at 3:24
  • Once again my chef skills are a little out of date so I can't pinpoint you to the exact location, but once you find it, you can follow this part of the tutorial to create the databags manually: docs.chef.io/data_bags.html#manually
    – Michael Pereira
    May 10, 2017 at 3:52
  • @Sam you can have local databags as test fixtures in kitchen. There should be a way to make it work with chef-zero too, but I haven't played with that at all.
    – chicks
    May 10, 2017 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.