Crypt is a tool for securely storing secrets such as FileVault 2 recovery keys. It is made up of a client app, and a Django web app for storing the keys.
This Docker image contains the fully configured Crypt Django web app. A default admin user has been preconfigured, use admin/password to login. If you intend on using the server for anything semi-serious it is a good idea to change the password or add a new admin user and delete the default one.
- Secrets are encrypted in the database
- All access is audited - all reasons for retrieval and approval are logged along side the users performing the actions
- Two step approval for retrieval of secrets is enabled by default
- Approval permission can be given to all users (so just any two users need to approve the retrieval) or a specific group of users
It is recommended that you use Docker to run this, but if you wish to run directly on a host, installation instructions are over on the in the docs directory
These settings are for the upcoming Crypt Server 3 release. Please refer to these settings for the present 2.x releases
All settings that would be entered into settings.py can also be passed into the Docker container as environment variables.
-
FIELD_ENCRYPTION_KEY- The key to use when encrypting the secrets. This is required. -
SEND_EMAIL- Crypt Server can send email notifcations when secrets are requested and approved. SetSEND_EMAILto True, and setHOST_NAMEto your server's host and URL scheme (e.g.https://crypt.example.com). For configuring your email settings, see the Django documentation. -
APPROVE_OWN- By default, users with approval permissons can approve their own key requests. By setting this to False in settings.py (or by using theAPPROVE_OWNenvironment variable with Docker), users cannot approve their own requests. -
ALL_APPROVE- By default, users need to be explicitly given approval permissions to approve key retrieval requests. By setting this to True insettings.py, all users are given this permission when they log in. -
ROTATE_VIEWED_SECRETS- With a compatible client (such as Crypt 3.2.0 and greater), Crypt Server can instruct the client to rotate the secret and re-escrow it when the secret has been viewed. Enable by setting this toTrueor by usingROTATE_VIEWED_SECRETSand setting totrue.
Main Page:
Computer Info:
User Key Request:
Manage Requests:
Approve Request:
Key Retrieval:
