[Scurity][Feature Request] Set "Security.encryption_key" via ENV

[Daniel-CS-Team]

Out of the box, misp-docker shows this warning in diagnostics:

Sensitive information like keys to remote server are stored in database unencrypted. Set Security.encryption_key to encrypt these values.

As this is a commandline-only setting, it would be nice to have it set during initial setup. Preferably provided via an ENV variable.
I agree that this is not a real issue if you use a dedicated database container not exposed to the outside world. But in our setup, we use an AWS AURORA cluster shared with some other services. So this is a nice security in depth control.

I solved this by utilizing the customize_misp.sh and an additional ENV variable. But I think it would be nice to add this functionality to the standard init-scripts. The relevant line is:

sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "Security.encryption_key" "${MISP_ENCRYPTION_KEY:=changeEncryptionKey0r1amUseless9}"

[ostefano]

Looks reasonable.

@UFOSmuggler is this something you can add next time you work on misp-docker?

[Diogo-Rego]

@ostefano adding it to core/files/etc/misp-docker/initialisation.defaults.json works

(...)
  "Security.encryption_key": {
    "default_value": "kjldsbnsjkhnamjfgvfn",
    "command_args": "-f"
  },
(...)

[ostefano]

You might want to move that settings to the envvars file, and test it when the value is empty (gracefully handling when the user does not set it). Then we can merge.

[ostefano]

See attached PR. @Diogo-Rego can I assign you as reviewer to both?

[Diogo-Rego]

@ostefano yes