Secrets in the env

Welcome to this simple project, an application launcher to load your secrets in environment variables or SSH private keys into your system's SSH agent, stored in a compatible vault

To-Do

• Add Hashicorp Vault as a vault compatible

Requirements

Compatible Operative Systems as host

• MacOS (including Chip M1 and M2)
• GNU/Linux
• Windows 10/11/Servers (including SSH-Agent).
  • For installing OpenSSH on Windows, see https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=gui

Software

• Python 3: https://www.python.org/
  • Dependences:
    • PyKeePass: https://github.com/libkeepass/pykeepass

Current compatible vaults

• KeePaas 2: https://keepass.info/

How to use

Install

Install on Unix-Like and MacOS:

$ pip install secretsintheenv

On Windows

PowerShell

PS C:\> pip install secretsintheenv

CMD

C:\> pip install secretsintheenv

Note: Hereinafter, to run on Windows you should add the .exe suffix to command Ex:

On Unix-Like:

$ ./secretsintheenv -h

On Windows:

PS C:\> secretsintheenv.exe -h

Note: In order to run:

$ secretsintheenv <arguments>

PS C:\> secretsintheenv.exe <arguments>

It is necessary to install with ADMIN RIGHTS (Using SUDO on Unix-Like or RUNAS on Windows, or similar)

If you install the pip packages with simple users privileges, you have to replace the command above by:

$  python -m secretsenv.secretsenv <arguments>

PS C:\> python.exe -m secretsenv.secretsenv <arguments>

Help

Just run:

$ secretsintheenv -h

Set-Up

Follow the next steps to reach out a good experience using this tool.

Step 1

First of all, you have to create your .secretsenv.conf config file on your home directory with the following content:

$ cat $HOME/.secretsenv.comf
[Config]
ssh = True
ssh-agent_type = ssh-agent
ssh-agent_path = /usr/bin/ssh-agent
vaults_file = /Path/to/vaults.conf
profiles_dir = /Path/to/profiles/directory/

• ssh (mandatory): enable or disable SSH-Agent
• ssh-agent_type (optional): just suport "ssh-agent" right now
• ssh-agent_path (optional): set the path of ssh-agent you prefer using
• vaults_file (mandatory): the file path where stored the vaults configurations. Also, it can be replaced by SECRETSENV_VAULTS_FILE environment variable
• profiles_dir (optional): the directory path where stored the profile files. Also, it can be replaced by SECRETSENV_PROFILES_DIR environment varaible

Note: Attributes can be set or replaced by command lines arguments. (See Help section)

Line with Hashtags (#) in the beginning are considered comments

Note: The .secretsenv.conf file and path can be replaced by using SECRETSENV_CONFIG_FILE environment variable. If you prefer using your own file, bear in mind to replace .secretsenv.conf by yours until the rest of this README.

Step 2

Once configured the .secretsenv.conf, the next step is to create the vaults file configuration in the path set within .secretsenv.conf

$ cat /Path/to/vaults.conf
[Section_Name]
type=<type of vault>
<attribute1>=<choose action>
<attribute2>=<choose action>
<attribute3>=<choose action>
[...]

• [Section_Name] (mandatory, Case Insensitive): Start a new section into file. Section_Name can be any name as you prefer, but it must be unique.
• type (manddatory, Case sensitive): Set the type of vault to be used. (See the Vaults section)
• attribute (case sensitive): The specific attribute to setup the specific vault.
  • The type of attribute depends on the vault to configure See the Vaults section for further information.
  • The <choose action> value can be the following:
    • prompt. To prompt in the screen and write the value
    • VAULT_NAME:QUERYSTR. To get the value from another vault. VAULT_NAME is the name of vault to be used set as [Section_Name] and QUERYSTR is the query string to retrieve the expected value.

You can write as many sections as you need, but remember not to repeat the name of the sections.

Note: To see exampled, please visit the section Examples

Step 3

So, we only need one file more (at least). We need to define the profile file (or several) to create the specific querys to retrieve our loved secrets.

The file can be named as you prefer, but it must include the suffix .secrets to work, and a content such as:

$ cat /Path/to/profiles/directory/PROFILE_NAME.secrets
[Section_Name]
<TYPE>@<TAGNAME1>=<VAULT_NAME1>:<QUERYSTR>
<TYPE>@<TAGNAME2>=<VAULT_NAME2>:<QUERYSTR>
<TYPE>@<TAGNAME3>=<VAULT_NAME3>:<QUERYSTR>
[...]

Similar to Vaults configuration file, you can define different sections by using the name you prefer, but unique by file, and then, set the different secrets you need to retrieve from specific vault.

Note: The sections can be defined as you prefer, but one way to use it can be to define different work environments (Prod, Qua, Stage, Dev, ...) and thus obtain the different secrets that your project requires at all times

• <TYPE>: Can be:
  • VAR: To retrieve the secret such as environment variable
  • SSH: To add the secret into SSH-AGENT running in your system
• <TAGNAME>: The name to identify the retrieved secret. When VAR is used, the TAGNAME will be the environment variable name
• <VAULT_NAME>: The vault name configured into vault configuration file
• <QUERYSTR>: The query string (specific by type of vault) to retrieve the secret

Just run

Once all requirements are configured, just use the tool as follows:

$ secretsintheenv profile profile_section action command

• profile: If not a path is set to a file, the tool will find your file into the "<profiles_dir>/.secrets" configured into the .secretsenv.conf file
• profile_section: To indicate the secrets to be retrieved written in the specific section within the profile file
• action:
  • run: to run the command set in the "command" argument
  • dump: to dump on screen the secrets content by the format set in the "command" argument

Examples

Assuming the following configured files:

 $ cat $HOME/.secretsenv.conf
 [Config]
 ssh = True
 #ssh-agent_type = ssh-agent
 #ssh-agent_path = /usr/bin/ssh-agent
 vaults_file = /Path/to/vaults.conf
 profiles_dir = /Path/to/profiles/directory

$ cat /Path/to/vaults.conf
[Personal]
type=keepass
db_path=/Path/to/Personal.kdbx
password=prompt
keyfile=/Path/to/Personal.key

[Project]
type=keepass
db_path=/Path/to/Project.kdbx
password=Personal:/Head Vaults/Project#field:password
keyfile=/Path/to/Project.key

Note: Project will retrieve the keepass password from the Personal vault, and Personal vault will prompt the password on screen to the user

$ cat /Path/to/profiles/directory/project.secrets
[QUA]
VAR@AWS_ACCESS_KEY_ID=Project:/path/to/record1#field:aws_access_keyid
VAR@AWS_SECRET_ACCESS_KEY=Project:/path/to/record2#field:aws_secret_access_key


[Prod]
VAR@AWS_ACCESS_KEY_ID=Project:/path/to/record1#field:aws_access_keyid
VAR@AWS_SECRET_ACCESS_KEY=Project:/path/to/record2#field:aws_secret_access_key
SSH@JUMP_SERVER1:Personal:/path/to/record20#attach:jump_server1.txt

DUMP IT!!

And just dump it to get the list of secrets on screen:

$ secretsintheenv project prod dump table

or, set the project file path

$ secretsintheenv /Path/to/profiles/directory/project.secrets prod dump table

Or, Get the environment variables to be directly used:

powershell_shell:

PS C:\> secretsintheenv.exe C:/Path/to/profiles/directory/project.secrets prod dump powershell_shell

cmd_shell:

PS C:\> secretsintheenv.exe project prod dump cmd_shell

unix_shell:

$ secretsintheenv project.secrets prod dump unix_shell

Or, even, to eval the results to load the variables in the current environment:

$ eval $(secretsintheenv /Path/to/profiles/directory/project.secrets prod dump unix_shell)

RUN IT!!!

Or, if you prefer, just run a command with the loaded secrets in memory (and SSH Key into SSH-Agent)

On Unix-Like systems:

$ secretsintheenv project.secrets prod run /bin/bash

$ secretsintheenv /Path/to/profiles/directory/project.secrets prod run /bin/zsh

On Windows systems:

PS C:\> secretsintheenv.exe C:/Path/to/profiles/directory/project.secrets prod run /bin/zsh

C:\> secretsintheenv.exe project prod run /bin/zsh

VAULTS

KeePaas

Vaults attributes:

• type=keepass (Mandatory)
• db_path= #Path to .kdbx file (Mandatory)
• password= #if used, the password to unencrypt the db_path file
• keyfile= #if used, the keyfile to unencrypt the db_path file

Query string format (QUERYSTR):

QUERYSTR format is:

  /path/to/record/into/keepass/file#record_type:record_name

• /path/to/record/into/keepass/file is the path to the record where the secret is stored in the KeePass database
• record_type: can get the following values:
  • field. To indicate that the secret is stored in a field
  • attach. To indicate that the secret is stored as an attachment
• record_name: The name of field or attachment where is stored the secret

Example:
[...]
VAR@AWS_ACCESS_KEY_ID=Project:/path/to/record1#field:aws_access_keyid
[...]