From f8022379e58b818f2d06b798b543eb3c93fafd4a Mon Sep 17 00:00:00 2001 From: William Gill Date: Tue, 22 Sep 2026 09:55:11 -0500 Subject: [PATCH] fix(openbao): stop documenting unseal keys on the command line deploy.sh's closing banner and README.md both instructed the operator to run `bao operator unseal -tls-skip-verify `, three times. That places an unseal key in the docker process's argv, and /proc//cmdline is world-readable -- so every user on the host can read it. Three of those shares reconstruct the master key, which makes this a worse instance of the leak class 0eb7f26 fixed for the token. `bao operator unseal` with NO key argument prompts for it with echo suppressed. Both places now say to pass nothing, and say why. These lines predate the updater and this session's work; anyone who followed the printed instructions has been exposing unseal shares to `ps` on that host. Co-Authored-By: Claude Opus 5 --- deployments/openbao/README.md | 6 +++++- deployments/openbao/deploy.sh | 5 ++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/deployments/openbao/README.md b/deployments/openbao/README.md index 3a1d05e..16d0a60 100644 --- a/deployments/openbao/README.md +++ b/deployments/openbao/README.md @@ -53,9 +53,13 @@ who connects): docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \ bao operator init -tls-skip-verify # prints 5 unseal keys + root token docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \ - bao operator unseal -tls-skip-verify # x3, three different keys + bao operator unseal -tls-skip-verify # x3, prompts hidden each time ``` +Pass **no key argument** — `unseal` prompts with echo off. A key given on the +command line lands in the docker process's argv, which `/proc//cmdline` +exposes to every user on the host; three of them reconstruct the master key. + **Store the unseal keys + root token out of band** — ideally age-encrypted with your backup recipient (`globals/age-pubkey.txt`), never on this host. diff --git a/deployments/openbao/deploy.sh b/deployments/openbao/deploy.sh index 7e91262..b0901b1 100644 --- a/deployments/openbao/deploy.sh +++ b/deployments/openbao/deploy.sh @@ -489,7 +489,10 @@ TLS: ${STACK_DIR}/tls/tls.crt (give this to the Kanrisha daemon as docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \\ bao operator init -tls-skip-verify docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \\ - bao operator unseal -tls-skip-verify # x3, three different keys + bao operator unseal -tls-skip-verify # x3, three different keys + Pass NO key argument: it then prompts with echo off. A key on the command + line lands in the docker process's argv, and /proc//cmdline is + world-readable -- three of those reconstruct the master key. 2. Bootstrap for Kanrisha. Run the Kanrisha repo's deploy/openbao/bootstrap.sh from a host that HAS the 'bao' CLI (the Kanrisha host or your workstation --