Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: Add security note about JWT and passwords in shell history #6011

Merged
merged 3 commits into from
Jul 15, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions docs/content/includes/installation/jwt-password-note.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
---
docs:
---

{{< note >}} For security, follow these practices with JSON Web Tokens (JWTs), passwords, and shell history:

1. **JWTs:** JWTs are sensitive information. Store them securely. Delete them after use to prevent unauthorized access.

1. **Shell history:** Commands that include JWTs or passwords are recorded in the history of your shell, in plain text. Clear your shell history after running such commands. For example, if you use bash, you can delete commands in your `~/.bash_history` file. Alternatively, you can run the `history -c` command to erase your shell history.

Follow these practices to help ensure the security of your system and data. {{< /note >}}
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,8 @@ You will need the following information from [MyF5](https://my.f5.com) for these

1. You can now use the newly created Kubernetes secret in Helm and manifest deployments.

{{< include "installation/jwt-password-note.md" >}}

---

## Manifest Deployment
Expand Down Expand Up @@ -198,3 +200,5 @@ docker login private-registry.nginx.com --username=<output_of_jwt_token> --passw

Replace the contents of `<output_of_jwt_token>` with the contents of the JWT token itself.
Once you have successfully pulled the image, you can then tag it as needed.

{{< include "installation/jwt-password-note.md" >}}