Mint panel install command still puts the enrollment token on the command line (node-26#18 server half) #215

New Issue

2026-10-04T18:10:26-04:00

logan commented

2026-10-04 18:10:26 -04:00

Server half of node-26#18. The mint panel in drb-frontend/app/settings/nodes/page.tsx:61-64 (from #106 and #107) still renders the paste-ready install command with the freshly minted token on the command line:

curl -fsSL …/install.sh | sudo bash -s -- --token ${justMinted} --node-id … --c2-url … --mqtt-broker …

That breaks the CISO condition from #61: the enrollment token must never appear as a plaintext CLI argument. The token ends up in the operator's shell history, and in ps for the whole install.

node-26 PR #30 makes install.sh prompt for the token on the TTY with hidden input. It also adds --token-file PATH and an exported DRB_ENROLLMENT_TOKEN for unattended installs. --token still works but now prints a deprecation warning.

Fix (after node-26 #30 merges and v1 is re-cut to include it):

Render the command without --token.
Show the token separately, with a copy button and the instruction "paste it when the installer asks".
Do not suggest sudo DRB_ENROLLMENT_TOKEN=… bash either. That puts the token on sudo's argv, which is the same leak.

Ordering matters: until v1 contains #30, the v1 install.sh only prompts when no --token is given. That happens to be compatible already, because do_fresh_enroll used ask_secret before #30 too. So this change can ship before or after the re-cut.

Typecheck is unverified on the authoring box (#207).

**Server half of node-26#18.** The mint panel in `drb-frontend/app/settings/nodes/page.tsx:61-64` (from #106 and #107) still renders the paste-ready install command with the freshly minted token on the command line: ``` curl -fsSL …/install.sh | sudo bash -s -- --token ${justMinted} --node-id … --c2-url … --mqtt-broker … ``` That breaks the CISO condition from #61: *the enrollment token must never appear as a plaintext CLI argument*. The token ends up in the operator's shell history, and in `ps` for the whole install. node-26 PR #30 makes `install.sh` prompt for the token on the TTY with hidden input. It also adds `--token-file PATH` and an exported `DRB_ENROLLMENT_TOKEN` for unattended installs. `--token` still works but now prints a deprecation warning. **Fix (after node-26 #30 merges and `v1` is re-cut to include it):** - Render the command **without** `--token`. - Show the token separately, with a copy button and the instruction "paste it when the installer asks". - Do not suggest `sudo DRB_ENROLLMENT_TOKEN=… bash` either. That puts the token on sudo's argv, which is the same leak. **Ordering matters:** until `v1` contains #30, the v1 `install.sh` only prompts when no `--token` is given. That happens to be compatible already, because `do_fresh_enroll` used `ask_secret` before #30 too. So this change can ship before or after the re-cut. Typecheck is unverified on the authoring box (#207).

logan added the area/frontend area/node-ota

labels 2026-10-05 02:05:04 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: logan/server-26#215