self-host
self-host copied to clipboard
bitwarden
Add ShareConfig Functionality for Secure Configuration Sharing to Bitwarden Self-Hosted (Bash)
Description
Introduces the shareconfig functionality to the Bitwarden self-hosted setup script, enabling administrators to securely share their Bitwarden configuration files. The shareconfig command sanitizes sensitive information by redacting values associated with passwords and secrets before compressing the configuration files into a tar.gz archive. This ensures that critical information remains secure when configuration files need to be shared for troubleshooting or auditing purposes.
Features
- [x] Redacts sensitive information, including passwords and secret keys, in
.conf,.env,.xml, and.ymlfiles within the Bitwarden configuration directory. - [x] Maintains the original directory structure in the compressed archive.
- [x] Generates a
tar.gzarchive of the sanitized configuration files, ready for secure sharing with support teams or for audit purposes.
Usage examples
To use this functionality, run the following command from the Bitwarden self-hosted script directory:
./bitwarden.sh shareconfig
This will generate a file named bitwarden-configs-redacted-<timestamp>.tar.gz in the current directory.
Testing
Please review this PR for inclusion in the next release of Bitwarden self-hosted. Your feedback and suggestions are welcome!
Checkmarx One – Scan Summary & Details – fbd1c9d8-9789-48bc-b018-4e7878ecf47f
No New Or Fixed Issues Found
How do we make sure that secrets added to new and existing environment files are redacted?
How do we make sure that secrets added to new and existing environment files are redacted?
Thank you for bring this up. To ensure the dynamic redaction of secrets from .env files and others, we could enhance the shareconfig function with a more comprehensive and adaptable regex pattern matching system.
\b(?:PASSWORD|SECRET|KEY|TOKEN)\s*=\s*.+
\b(?:PASSWORD|SECRET|KEY|TOKEN)\s*:\s*.+
But still these patterns would be to catch common ways, they wouldn't cover still new situations. Open to new suggestions to investigate.
As discussed, we should put a disclaimer on the script stating the files and values we have masked and that the user to verify there are no additional config files that container secrets. This ensures they are agreeing that there might be secrets that are still shared.
