install.sh --token puts the enrollment token on the command line (shell history + ps) — CISO condition from server-26#61 unmet #18

New Issue

2026-10-04T01:11:46-04:00

logan commented

2026-10-04 01:11:46 -04:00

Board condition (server-26#61, quoted on node-26#4): the enrollment token must never appear as a plaintext CLI argument. Two places still put it there:

install.sh --token DRB-…
the mint panel's paste-ready curl … | sudo bash -s -- --token … line (server-26#106)

Both land in shell history and in ps for the whole install. node-26#16 removed the token from curl's argv (it now goes through a 0600 header file) but left the CLI flag alone.

Fix direction:

read the token from DRB_ENROLLMENT_TOKEN, from --token-file PATH, or from a TTY prompt
change the mint panel to DRB_ENROLLMENT_TOKEN=… sudo -E bash or a prompt
keep --token with a deprecation warning

Board condition (server-26#61, quoted on node-26#4): *the enrollment token must never appear as a plaintext CLI argument*. Two places still put it there: - `install.sh --token DRB-…` - the mint panel's paste-ready `curl … | sudo bash -s -- --token …` line (server-26#106) Both land in shell history and in `ps` for the whole install. node-26#16 removed the token from **curl's** argv (it now goes through a 0600 header file) but left the CLI flag alone. Fix direction: - read the token from `DRB_ENROLLMENT_TOKEN`, from `--token-file PATH`, or from a TTY prompt - change the mint panel to `DRB_ENROLLMENT_TOKEN=… sudo -E bash` or a prompt - keep `--token` with a deprecation warning

logan referenced this issue

2026-10-04 01:12:07 -04:00

Node enrolled via install.sh never comes online if approved after install (Toughny) — no client-side key pickup, and re-run doesn't restart edge-node #14

logan referenced this issue from a commit

2026-10-04 18:09:26 -04:00

install.sh: enrollment token never on the command line (node-26#18)

logan referenced a pull request that will close this issue

2026-10-04 18:10:06 -04:00

install.sh: enrollment token never on the command line (#18) #30

logan commented

2026-10-04 18:10:37 -04:00

Checked origin/main (80a0e88, which is also v1): not fixed. 3269203 only moved the token off curl's argv. --token was still the documented path, in the header, --help, README and every re-run hint.

The fix is in PR #30 (fix/18-install-token-argv):

the token is prompted for on the TTY, with hidden input;
unattended installs use --token-file PATH or an exported DRB_ENROLLMENT_TOKEN;
--token still works but is deprecated and prints a warning.

The mint panel half is filed as server-26#215. This issue closes when #30 merges.

Checked origin/main (`80a0e88`, which is also `v1`): **not fixed**. `3269203` only moved the token off **curl's** argv. `--token` was still the documented path, in the header, `--help`, README and every re-run hint. The fix is in **PR #30** (`fix/18-install-token-argv`): - the token is prompted for on the TTY, with hidden input; - unattended installs use `--token-file PATH` or an exported `DRB_ENROLLMENT_TOKEN`; - `--token` still works but is deprecated and prints a warning. The mint panel half is filed as **server-26#215**. This issue closes when #30 merges.

logan closed this issue

2026-10-04 18:28:19 -04:00

logan referenced this issue from a commit

2026-10-04 18:28:20 -04:00

Merge pull request 'install.sh: enrollment token never on the command line (#18)' (#30) from fix/18-install-token-argv into main

logan added the area/node-ota

type

security

labels 2026-10-05 02:05:10 -04:00

Sign in to join this conversation.