Package: credo_manager
The python implementation of Credulous (https://github.com/realestate-com-au/credulous)Essentially, it’s a credential management program written with amazon
credentials in mind. It uses your ssh key pairs to keep your credentials
encrypted on disk until you need to use them.InstallationUse pip!:pip install credo_managerUsageImport some keys:credo importExport those keys to your environment:`credo exports`
# Display prints out the required environment exports
# The backticks means your shell will run those exportsOr execute a command with those keys:credo exec bash -c 'echo $AWS_ACCESS_KEY_ID'All credo commands take:credo <credo_options> 
 <action_options>Where <credo_options> help filter out the different keys you have stored.Upon ambiguity credo will ask you questions and tries it’s best to provide cli
options to remove that ambiguity when you use the command.For example, when importing keys, credo will look for environment variables,
boto configuration, aws configuration or allow you to specify your own keys.
It will only prompt you for the sources it finds, or you can say what source
you want:credo import --source environmentThe <credo_options> filter can be:-u/–user <user>Where user is either the name of the user oruser@accountoruser@account@repo. Account and repo specified here will override the
other filters-a/–account <account>Where account is either the name of the account oraccount@repo. Repo
specified here will override anything in the –repo filter.-r/–repo <repo>Where repo is the name of the repository.StatusCurrently Credo seems to work fine.Though, I haven’t written tests for the majority of it, so I’ll make no
guarantees at the moment.No tests means my implementation is a bit messier than I would like and it’s
likely there are hidden bugs in some of the code that handles the corner cases
I don’t see in my normal usage.So until tests are written, this should beconsidered alpha quality.FeaturesCredo usage allows you to specify what you want to do via the cli and credo will
ask questions for any ambiguity it comes across.credo exportsPrint out export lines for exporting the credentialscredo injectAn alias for credo exportsCredo inject will be registered as sourceable by the credo sourceable commandcredo execRun a command with credentials in the environment of that commandcredo importAdd credentialscredo rotateRotate credentialscredo showShow what credentials credo is currently aware ofcredo currentDisplay the username, account alias and account id of the amazon credentials
you currently have in your environment.credo synchronizeMake a repository synced with it’s remotecredo captureCapture environment variablescredo envDisplay only environment variables that have been capturedcredo unsetReset any environment variables credo has changed to what they were before
credo set themcredo remoteAllows you to edit the remote for some repository. All commands will add
changes as they are made and will try to synchronise with any remote that is
set.Note that this functionality is extremely rudimentaryVersioning without a remoteMakes it a git repository without adding any remoteNo versioning at allRemoves any .git folder in that repositoryVersioning with some remoteIf not already versioned, makes it a git folder, and makes sure we have
the remote set as specified.credo sourceable <argv>Exits with 0 (yes) or 1 (no) to say whether the output of running credo with
the specified arguments should be sourced into the running shell.See the Advanced Usage section to see this in use.Note that if you give “–no-sourcing” as an action option, then sourceable
will say this command should not be sourcedcredo register_samlUsed to register an idp provider so that when you do an inject it is
available as a source of credentialscredo serveServe a fake metadata service. This needs to be run as root so that we can bind
to port 80 on 169.254.169.254.<look further down for more instructions>credo switchTell the fake metadata service which credentials to use. It behaves just likeinject.credo print_shell_functionDump some helper shell functions that you can add into your shrc.credo output_extensionWhere to save your Chrome Extension.credo create_launch_daemonTask to generate a launchd.plist configuration.It also does:Stores your credentials so that you have repositories of users in particular
accounts.Import from environment, ~/.boto, ~/.aws/config or values you specifyKnows about profiles in ~/.boto and ~/.aws/configUses signatures to ensure that only you ever write encrypted credentialsUses signatures to ensure that the credentials you load is for the account
that you think it is forCopes when keys are no longer usable.Lets you specify urls or just pem_data for the public keys per repository and
caches what it findsMinimises the number of times you need to enter a password for your private
keysTries it’s best to find situations it can’t handle and display nice error
messages to the screenTries to be informative about what is happeningRotate keys automaticallyCan capture environment variables per repository, account and userRetrieve credentials from a saml based identity providerRotationCredo will do key rotation similar to credulous.It does this by recording a “half_life” for each key, which is the number of
seconds since the creation of the key before it “rotates”.Rotation means the other key (amazon only allows you to have two keys) gets
deleted and a new key is created.Also, if a key is older than twice it’s half life, it’s deleted.When credo chooses a key to use, it will always use the youngest key.Credo also handles the following situations:Both keys are no longer workingThere is a key in amazon credo doesn’t know about
* Credo asks if you want to delete it or tell it the secret keyBoth keys credo knows about are past their half lifeBoth keys credo knows about are both past twice their half lifeThe keys credo knows about don’t need to be deleted or rotatedLayoutCredo will layout your credentials using the following folder structure:~/.credo/
    config.json

    repos/
        <repository>/
            keys
            env.json
            <account>/
                account_id
                env.json
                <user>/
                    username
                    env.json
                    credentials.jsonWhereconfig.jsonhas some configuration for credo,account_idholds
the id of the amazon account represented by that folder, andcredentials.jsonhas amazon credential for that user and account.Thekeysfile holds the pems you want credo to encrypt details with. It is
signed by one of your private keys to ensure only your public keys are in this
file.Theaccount_idis a file with one line containing
“<account_id>,<fingerprint>,<signature>” where the fingerprint and signature is
used to verify that one of your private keys recorded this account_id under this
account and repository. This is to ensure that the credentials found in
credentials.json do actually belong to this account and repo.Theusernameis a file like theaccount_idbut holds the amazon username
associated with this user, and a signature used to validate this name.Thecredentials.jsoncontains the credentials encrypted with each public key
it knows about and a signature used to verify that the credentials were written
using one of you private keys against a particular account and user.This means you may only add credentials using one of your private keys.The format ofcredentials.jsonincludes the half_life of the key, the epoch
signifying when that credential was created and for each key we use to decrypt
the data, a secret that is encrypted with your ssh key, a signature saying your
private key created that secret, and the credentials themselves encrypted with
AES using that secret.Eachenv.jsonfile has a similar format tocredentials.jsonbut it has
type ofenvironmentand includes environment variables that have been captured
by thecredo capturecommand.Changelog0.5.3Update requests for CVE-2018-180740.5.2Update paramiko for CVE-2018-10008050.5.1Update pycryptodome for CVE-2018-155600.5Stop using pycrpto (it’s unmaintained and has a cve)Upgrade other dependencies0.4.4Some fixes0.4.3Python3 supportSome fixesReadme improvement0.4.2Trying to fix the launchdaemon to use correct home directory0.4.1Fixed a bug with the chrome extensionFixed a bug with generating the shell scriptAdded a –config option0.4.0Add more support for credo server.0.3.3Fixed the credo import function0.3.2Some fixes to credo serve0.3.1Doesn’t ask for half_life multiple timesHas a don’t rotate optionOne less bug with saving keys on rotateFixed a bug with importing from a boto config0.3.0Added serve and switch to act as a fake metadata service0.2.8Some minor fixes0.2.7Added register_saml functionAnd the ability to get credentials from a saml identity provider0.2.6Pinning install_requires dependenciesUsing delfick_error now0.2.5Fixed bug where credo would crash if your ~/.ssh folder had subfoldersCan now specify –half-life when you do a rotate, exec, inject or exportsYou can now set ahalf_lifeoption in ~/.credo/config0.2.4Made it so that –help when used with credo sourceable doesn’t return
exit code 0 because the bash helper would source –help output0.2.3Made pygit2 optional because compiling libgit2 is annoying0.2.1 and 0.2.2Tiny bug fixes I noticed after release0.2Initial version that is open-sourcedThe Magic Metadata ServerThe magic metadata server provides your local IAM tools with credentials needed
to access your AWS account. It works the same way an ec2 instance is able to
access it’s role credentials (overhttp://169.254.169.254).There are two parts of the server.The credo shell function that is used as a wrapper to access thecredotool in your virtualenv.The LaunchDaemon plist which defines how to start the magic metadata
server.Setting up the Magic Metadata ServerThe magic metadata server listens athttp://169.254.169.254on your local
machine.Currently it only supports /latest/meta-data/iam/security-credentials, thus
allowing any amazon sdk to authenticate with Amazon.Also, it only works with identity provider credentials (so it won’t work with
the user credentials you’ve imported into credo) but that restriction aside,
it does work.To setup it up on your computer, follow the following instructions:First, let’s choose where you’re gonna create a virtualenv for credo.Let’s say~/credo_venv, but you can change that to what you want:virtualenv ~/credo_venvsource ~/credo_venv/bin/activatepip install credo_manager tornado flaskcredo create_launch_daemonFinally, we shall import accounts:credo register_samlFor each account runcredo import--sourcesaml_providerSetting up HelpersTo help you use the credo, there are some CLI tools and Chrome Extension.Install the CLI tools:credo print_shell_functionand follow instructions.Install the Chrome Extensions:credo output_extension--output~/credo_venv/extand follow instructions.To quickly switch between environments, you can now run the commandswitch <environment>.Enjoy your new Magic Metadata Server.TestsIf you’re developing it:pip install -e .
pip install -e ".[tests]"Run the helpful script:./test.shGit Integration** The Git integration doesn’t really work. **Install the dependencies:Mac OSX:brew install libgit2 gmpFor ubuntu:sudo add-apt-repository ppa:dennis/python
sudo apt-get update
sudo apt-get install python-crypto python-pygit2For other systems, see theCompiled Python Dependenciessection belowCompiled Python dependenciesIf you don’t want to use pre-built packages for pycrypto you could make sure you
don’t have that package installed, then install the python development libraries
and the gmp development libraries (gmp is needed for crypto to be faster).So,For Debian systems, something likesudo apt-get install libpython-dev libgmp-devFor those with yumyum install python-devel gmp-develAnd then dopip install credo.You can also compile libgit2 yourself if you want:# sudo apt-get install cmake gcc
# or
# sudo yum install cmake make gcc

git clone -b master git://github.com/libgit2/libgit2.git
mkdir libgit2/build
cd libgit2/build
cmake ..
cmake --build .
sudo cmake --build . --target install

pip install pygit2Pygit2 is an optional dependency, and for now, git support is rather weak anyway.