Are Symfony Secrets safe because both keys are saved on the server?

Question

After reading some articles about the EmeraldWhale-malware collecting sensitive credentials through Git I am looking for best-practices to use environment variables in a Symfony project.

1. A option would be to set the environment variables at runtime like: DB_NAME=my_database DB_USER=my_user DB_PASSWORD=my_password symfony server:start By using this method you wouldn't even ever have a .env-file for production, mitigating the risk of even ever publishing the credentials through accidentally pushing a .env file to your VCS.

2. I also took a look at Symfony Secrets. This seems way more secure then using global CLI variables or a .env. But because both the private- and public-key for this asymmetric encryption is saved on the server, how exactly is this more secure? An intruder accessing the server could still use the private-key to get the credentials (same for CLI variables), but in this case the private key could still be pushed to a VCS by accident like a .env-file?

So, what is the most secure and best-practice way to store your credentials in a Symfony project?

Answer 1

As you correctly point out, the master key pair for the Symfony vault is stored as plaintext in a file. If this file gets compromised, then so do all secrets. Really the only benefit of this approach is that instead of having to protect multiple secrets scattered across configuration files, you only have to take care of a a single master secret at a clearly defined location.

Setting secrets when the application is started can mitigate some risks (e.g., you cannot accidentally commit them), but it's not perfect either. The plaintext keys are still accessible to the application and may also be logged as command line arguments.

A better approach is to use the key store provided by the operating system, e.g., the Linux Kernel Key Retention Service. This allows you to keep keys in kernel space. If you additionally perform all cryptographic operations with the Linux Kernel Crypto API, then you can avoid ever exposing the key to userspace (this is what Cloudflare does, for example). Using a Trusted Platform Module as a hardware-based solution would be another option. However, I'm not aware that PHP – let alone Symfony – supports any of this directly, so you'll need to implement some agent program or PHP extension. Whether the effort is justified depends entirely on the value of the application data and the risks you're facing (which are hard to assess without knowing the application and server setup).