How can I save my secret keys and password securely in my version control system?

by

You’re exactly right to want to encrypt your sensitive settings file while still maintaining the file in version control. As you mention, the best solution would be one in which Git will transparently encrypt certain sensitive files when you push them so that locally (i.e. on any machine which has your certificate) you can use the settings file, but Git or Dropbox or whoever is storing your files under VC does not have the ability to read the information in plaintext.

Tutorial on Transparent Encryption/Decryption during Push/Pull

This gist https://gist.github.com/873637 shows a tutorial on how to use the Git’s smudge/clean filter driver with openssl to transparently encrypt pushed files. You just need to do some initial setup.

Summary of How it Works

You’ll basically be creating a .gitencrypt folder containing 3 bash scripts,

clean_filter_openssl 
smudge_filter_openssl 
diff_filter_openssl

which are used by Git for decryption, encryption, and supporting Git diff. A master passphrase and salt (fixed!) is defined inside these scripts and you MUST ensure that .gitencrypt is never actually pushed.
Example clean_filter_openssl script:

#!/bin/bash

SALT_FIXED=<your-salt> # 24 or less hex characters
PASS_FIXED=<your-passphrase>

openssl enc -base64 -aes-256-ecb -S $SALT_FIXED -k $PASS_FIXED

Similar for smudge_filter_open_ssl and diff_filter_oepnssl. See Gist.

Your repo with sensitive information should have a .gitattribute file (unencrypted and included in repo) which references the .gitencrypt directory (which contains everything Git needs to encrypt/decrypt the project transparently) and which is present on your local machine.

.gitattribute contents:

* filter=openssl diff=openssl
[merge]
    renormalize = true

Finally, you will also need to add the following content to your .git/config file

[filter "openssl"]
    smudge = ~/.gitencrypt/smudge_filter_openssl
    clean = ~/.gitencrypt/clean_filter_openssl
[diff "openssl"]
    textconv = ~/.gitencrypt/diff_filter_openssl

Now, when you push the repository containing your sensitive information to a remote repository, the files will be transparently encrypted. When you pull from a local machine which has the .gitencrypt directory (containing your passphrase), the files will be transparently decrypted.

Notes

I should note that this tutorial does not describe a way to only encrypt your sensitive settings file. This will transparently encrypt the entire repository that is pushed to the remote VC host and decrypt the entire repository so it is entirely decrypted locally. To achieve the behavior you want, you could place sensitive files for one or many projects in one sensitive_settings_repo. You could investigate how this transparent encryption technique works with Git submodules http://git-scm.com/book/en/Git-Tools-Submodules if you really need the sensitive files to be in the same repository.

The use of a fixed passphrase could theoretically lead to brute-force vulnerabilities if attackers had access to many encrypted repos/files. IMO, the probability of this is very low. As a note at the bottom of this tutorial mentions, not using a fixed passphrase will result in local versions of a repo on different machines always showing that changes have occurred with ‘git status’.

More Related Contents:

  1. Should I be adding the Django migration files in the .gitignore file?
  2. Best practices for adding .gitignore file for Python projects? [closed]
  3. How to write setup.py to include a Git repository as a dependency
  4. How to run cloned Django project?
  5. Does the django-rest-framework provide an admin site to manage models?
  6. Django dynamic model fields
  7. How to convert JSON data into a Python object?
  8. Django filter queryset __in for *every* item in list
  9. How to execute a Python script from the Django shell?
  10. Django, creating a custom 500/404 error page
  11. Django: Redirect to previous page after login
  12. How do I force Django to ignore any caches and reload data?
  13. Django: Adding “NULLS LAST” to query
  14. Serving dynamically generated ZIP archives in Django
  15. Django Rest Framework writable nested serializers
  16. How can I schedule a Task to execute at a specific time using celery?
  17. Django and query string parameters
  18. Django circular model reference
  19. Access request in django custom template tags
  20. How to install virtualenv without using sudo?
  21. Heroku fails to install pywin32 library
  22. How does the order of mixins affect the derived class?
  23. Django widget override template
  24. How to assign a local file to the FileField in Django?
  25. ImportError: Could not import settings
  26. Django: When to customize save vs using post-save signal
  27. Writable nested serializer in django-rest-framework?
  28. Add custom form fields that are not part of the model (Django)
  29. Can a dictionary be passed to django models on create?
  30. How can I call ‘git pull’ from within Python?

Leave a Comment