Logan Cusano
e6aab7589a
The source password had a `hackme` fallback in five places -- entrypoint.sh,
docker-compose.yml, setup.sh's prompt default, .env.example, edge-node's
config.py -- plus op25-container's os.getenv default and two README rows. Any
node whose operator pressed Enter through setup.sh is running a credential
that is written down in this repo.
That matters more than the usual default-password case because Icecast binds
all interfaces and the SOURCE password is write access: it does not just let a
LAN neighbour listen, it lets them PUSH audio into the stream the frontend and
mobile clients play as live radio. Injecting fake traffic into a public-safety
feed is the failure worth preventing.
Approach: remove every fallback rather than change them to a better default.
- icecast/entrypoint.sh refuses to start if either password is empty, and says
how to generate one. This is the single hard gate; everything else is
defence in depth behind it.
- docker-compose.yml uses ${VAR:?message} so a missing value stops the stack
at compose time with a readable error instead of becoming an empty string.
- setup.sh GENERATES a random password when the operator presses Enter, via
openssl rand -base64 24 with a /dev/urandom fallback. Pressing Enter now
gives you a random password rather than a known one, which is the actual
behaviour change -- a prompt default nobody types over is not a default, it
is the value.
- .env.example ships the keys empty with the generation command in a comment,
and README.md now marks both as required with no default.
Client suite: 185 passed.
Note this does NOT rotate anything already deployed. node-002's .env still has
whatever it was set up with; that is an operational step, tracked in the issue.
Closes logan/node-26#3
23 lines
805 B
Bash
23 lines
805 B
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
# No defaults here on purpose. This container binds all interfaces, so a
|
|
# fallback password is a published credential on every node that ever accepted
|
|
# it -- and the source password is what lets a caller PUSH audio into the
|
|
# stream the frontend plays as live radio. Refuse to start instead.
|
|
for var in ICECAST_SOURCE_PASSWORD ICECAST_ADMIN_PASSWORD; do
|
|
eval "value=\${$var}"
|
|
if [ -z "$value" ]; then
|
|
echo "icecast: $var is not set." >&2
|
|
echo "icecast: set it in the node's .env -- 'bash setup.sh' generates a random one," >&2
|
|
echo "icecast: or run: openssl rand -base64 24" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
export ICECAST_SOURCE_PASSWORD ICECAST_ADMIN_PASSWORD
|
|
|
|
envsubst < /etc/icecast2/icecast.xml.template > /tmp/icecast.xml
|
|
|
|
exec gosu icecast icecast2 -c /tmp/icecast.xml
|