Skip to content
Unverified Commit 2d989828 authored by anon-software's avatar anon-software Committed by GitHub
Browse files

Security exposure related to the token (#356)

* Security exposure related to the token

The installation playbook saves the token into the systemd unit
configuration file /etc/systemd/system/k3s.service. The problem is that
according to K3s' documentation "the server token should be guarded
carefully" (https://docs.k3s.io/cli/token), yet the configuration file
is readable by anybody. A better solution is to save the token into its
corresponding environment file /etc/systemd/system/k3s.service.env which
is readable by the super user only. This is what the standard K3s'
installation script (https://get.k3s.io

) does.

Signed-off-by: default avatarMarko Vukovic <8951449+anon-software@users.noreply.github.com>

* Restore the server URL into systemd configuration file

There aren't any security implications in keeping it there.

Signed-off-by: default avatarMarko Vukovic <8951449+anon-software@users.noreply.github.com>

---------

Signed-off-by: default avatarMarko Vukovic <8951449+anon-software@users.noreply.github.com>
parent 3e0c982a
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment