Get started using secrets
Secrets are stored in AWS Secrets Manager. You will need to be on-boarded to GovWifi’s AWS Staging and Production accounts in order to access these secrets.
Secrets Manager
Once you have access to the AWS console, navigate to the Secrets Manager service in AWS.
The relevant credentials are listed in the following format: <service>/<item>.
Pass & GPG
All other sensitive information (such as private IP addresses) are stored in govwifi-build. This information is pulled in when terraform is run.
All shell commands assume you are running from within the govwifi-terraform
repository since the govwifi-build repository is cloned in the
.private directory of govwifi-terraform.
GPG Tools
To use these secrets, you will need the Password Store tool installed on your machine and an environment variable to point to the location of the store, e.g. Macbook CLI
echo export PASSWORD_STORE_DIR="/Users/[YOUR_USERNAME]]/[PATH_TO]/govwifi-build/passwords" >> ~/.bashrc
Execute the updated .bashrc e.g.
. ~/.bashrc ; echo $PASSWORD_STORE_DIR
You will also need an implementation of gpg installed. This will be installable under the name gnupg:
apt/brew/dnf/rpm/yum install gnupg
Getting access
Once you have installed the tools, you will need someone to re-encrypt the secrets with your public key.
Give someone your full key ID:
gpg --list-keys '<name>@digital.cabinet-office.gov.uk'
An example of a key ID is: 06D20CF70AC370DE72F49EDC992939FDD5C5144C
Please also ensure your public key is on a well known keyserver:
We suggest keyserver.ubuntu.com as they are known to be reliable.
gpg --keyserver keyserver.ubuntu.com --send-keys '<your key ID>'
Giving Access
The new joiner must first send their GPG key ID to a current member of the team.
Once the key is received, all team members must use the receive-keys option to accept it and provide the key with ultimate trust:
key_id='<their key ID>'
gpg --keyserver keyserver.ubuntu.com --receive-keys "$key_id"
echo "${key_id}:6" | gpg --import-ownertrust
To on-board the new GPG key, navigate to the .private directory in the govwifi-terraform project.
Checkout a new branch in .private:
$ git checkout -b onboarding_<NAME>_GPG_key
Append the new key to the .private/passwords/.gpg-id file:
echo "$key_id" >> '.private/passwords/.gpg-id'
Change directory to the root project (govwifi-terraform/), then re-encrypt the passwords from within the govwifi-terraform repo:
make rencrypt-passwords
Note: make commands can only be run from the root project directory.
There can be a number of reason for this to fail, for example one of the keys could have expired, if that’s the case, contact the owner of the key and ask them to extend their expiration date and reupload their key to the server, the procedure to follow for extending expired key can be found in the Extend Expiry below
once they’ve done this, upload the key again.
Once the secrets have been re-encrypted, use git to add, commit and push the changes in the .private directory.
Raise a PR in the govwifi-build repo on Github. Ask another team member to test the encryption has worked by checking out the PR branch and testing they can decrypt the files using gpg -d.
Extend Expired GPG Key
To extend the expiry of an existing GPG Primary and Sub key
$ gpg --list-keys
$ gpg --edit-key KEYID`
> expire
> 2y
> y
> key 1 ## < sub key >
> 2y
> y
> trust
> 5
> save <-- Very important!
Then upload the updated keys to the server
sh
gpg --keyserver keyserver.ubuntu.com --send-keys KEDID
Export / Backup the key
To keep a backup of your key ‘in a SECURE location’
sh
gpg -a --export KEYID > name.gpg.public
gpg -a --export-secret-keys KEYID > name.gpg.private
Test the new key
To Test out the new key, try to do a round trip:
sh
gpg -ea > secret.out
gpg -d secret.out
New members
New members must import all the existing gpg keys that are stored.
To do this read in all the keys in passwords/.gpg-id and import them:
$ gpg --keyserver keyserver.ubuntu.com --receive-keys <key_id> && gpg --import-ownertrust
If you are a new starter you’ll have to do this for every team members key, so to speed things up, ‘cat’ out the keys and use the output in the receive-keys command. “`sh
get all the keys
cat .gpg-id | tr ‘\n’ ‘ ’
paste the output to.
gpg –keyserver keyserver.ubuntu.com –receive-keys
Getting a secret
Throughout the documentation there will be references to specific secrets stored within the password store.
To read individual secrets, run the command:
PASSWORD_STORE_DIR=<password_store_dir> pass show <secret_name>
where:
<password_store_dir>is the path of thepasswordsdirectory of the govwifi-build repository on your local machine.<secret_name>is the path of the secret that you want to display. You can omit this to get a list of all secret paths.
For example, if you want to access the Staging Bastion SSH Key:
PASSWORD_STORE_DIR=.private/passwords pass show keys/govwifi-staging-bastion-key
Adding/Editing a secret
Use pass to edit your file for ease - you can be anywhere when you do this - the
PASSWORD_STORE_DIR=<password_store_dir> pass edit <secret_name>
Example:
PASSWORD_STORE_DIR=~/govwifi-build/passwords pass edit your_secret.txt
Make your changes and save them. They will be re-encrypted automatically if all your gpg keys are up to date.