From db71dd8c55613c4bfb740936ab52cd77df961d34 Mon Sep 17 00:00:00 2001 From: Simon Hollenbach Date: Mon, 10 Jan 2022 18:31:02 +0100 Subject: [PATCH 1/3] docs/configuration: Fix entropy for bash secret Filtering `/dev/urandom` for alphanumeric characters resulted in loss of input entropy to base64. Fixing this using a procedure with these steps: * Read 32 bytes from `/dev/urandom` (`dd`) * Base64-encode (`base64`) * Strip newlines (`tr -d`) * URL-Escape (`tr`) * Append a final newline (`echo`) This output should be equivalent to output generated using Python and OpenSSL variants mentioned in the changed document file. Newlines are stripped as `base64` wraps its output and the option to disable this (`-w 0`) is not available in all implementations. Fixes: #1511 --- docs/docs/configuration/overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/docs/configuration/overview.md b/docs/docs/configuration/overview.md index 197c862c..35ed4be3 100644 --- a/docs/docs/configuration/overview.md +++ b/docs/docs/configuration/overview.md @@ -31,7 +31,7 @@ import TabItem from '@theme/TabItem'; ```shell - cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1 | base64 + dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_'; echo ``` From 4ed564901e81b5633c8b891c3648cd714d5a3138 Mon Sep 17 00:00:00 2001 From: Simon Hollenbach Date: Sun, 20 Feb 2022 14:29:14 +0100 Subject: [PATCH 2/3] docs/versioned_docs: Backport fix entropy for bash secret (#1511) --- docs/versioned_docs/version-6.1.x/configuration/overview.md | 2 +- docs/versioned_docs/version-7.0.x/configuration/overview.md | 2 +- docs/versioned_docs/version-7.2.x/configuration/overview.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/versioned_docs/version-6.1.x/configuration/overview.md b/docs/versioned_docs/version-6.1.x/configuration/overview.md index 229aac85..5c0cbf95 100644 --- a/docs/versioned_docs/version-6.1.x/configuration/overview.md +++ b/docs/versioned_docs/version-6.1.x/configuration/overview.md @@ -31,7 +31,7 @@ import TabItem from '@theme/TabItem'; ```shell - cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1 | base64 + dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_'; echo ``` diff --git a/docs/versioned_docs/version-7.0.x/configuration/overview.md b/docs/versioned_docs/version-7.0.x/configuration/overview.md index 938a1b77..b77a5517 100644 --- a/docs/versioned_docs/version-7.0.x/configuration/overview.md +++ b/docs/versioned_docs/version-7.0.x/configuration/overview.md @@ -31,7 +31,7 @@ import TabItem from '@theme/TabItem'; ```shell - cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1 | base64 + dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_'; echo ``` diff --git a/docs/versioned_docs/version-7.2.x/configuration/overview.md b/docs/versioned_docs/version-7.2.x/configuration/overview.md index a5df97dd..092fb7dc 100644 --- a/docs/versioned_docs/version-7.2.x/configuration/overview.md +++ b/docs/versioned_docs/version-7.2.x/configuration/overview.md @@ -31,7 +31,7 @@ import TabItem from '@theme/TabItem'; ```shell - cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1 | base64 + dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_'; echo ``` From b999c41a5aed023a272fda18518a2c9a85c3bef3 Mon Sep 17 00:00:00 2001 From: Simon Hollenbach Date: Sun, 20 Feb 2022 14:41:46 +0100 Subject: [PATCH 3/3] docs/7.1.x/configuration: Use 32 bytes to generate secret --- docs/versioned_docs/version-7.1.x/configuration/overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/versioned_docs/version-7.1.x/configuration/overview.md b/docs/versioned_docs/version-7.1.x/configuration/overview.md index f211f507..9a2113e7 100644 --- a/docs/versioned_docs/version-7.1.x/configuration/overview.md +++ b/docs/versioned_docs/version-7.1.x/configuration/overview.md @@ -7,7 +7,7 @@ title: Overview ### Generating a Cookie Secret -To generate a strong cookie secret use `python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'` +To generate a strong cookie secret use `python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'` ### Config File