Before we are looking into the details how to setup a non-anynomous connection to Domino’s Proton server, I have an advice for protecting the key files required for the connection.<\/p>\n
The keys are not password protected, and this is a high risk which should be avoided: First, if you make a mistake or if there is a bug in the software, the keys could be accessed from „outside“. And second, if you check in your code in a repository, the IT security should roast you. It’s clear that the keys are still unprotected if someone hacks the application, but this is a different topic.<\/p>\n
First thing to to is to encrypt the keys with AES. To achive this, we are using openssl<\/em>:<\/p>\n The parameter -k<\/em> is the key to use for encryption. The path to the unencrypted file is passed with -in<\/em>, and -out<\/em> is the path of the encrypted file.<\/p>\n I also encryted the .crt<\/em> files, which is not required, but it does not hurt either<\/span><\/span>.<\/p>\n The config.js<\/em> file must now be changed to the follwing (a new method for reading and decrypting the files with openssl<\/em> is added):<\/p>\n But where to store the key? Nowhere, the key is stored in an evironmental variable.<\/p>\n This line reads the value from the variable PASSWORD_KEYFILES<\/em>.<\/p>\n When running your application in a docker container, just start the container with the following command including the variable:<\/p>\n To use it in a IDE like Visual Studio Code, you have to add it to the debugging configuration:<\/p>\n Now you can add the .enc<\/em> files to your application in folder \/app\/certs<\/em> without worrying about it. If the variable is not set, the application terminates with error code 1.<\/p>\n P.S. Don’t forget to remove the original key files from your project!<\/p>\n","protected":false},"excerpt":{"rendered":" Before we are looking into the details how to setup a non-anynomous connection to Domino’s Proton server, I have an advice for protecting the key files required for the connection. The keys are not password protected, and this is a … Weiterlesen openssl enc -aes-256-cbc -k \"0123456789\" -in domino-express.key -out domino-express.key.enc<\/code><\/pre>\nconst exec = require('child_process').execSync;\r\n\r\nconst path = require('path');\r\n\r\n\/**\r\n * reads an aes-256-cbc encrypted file & decrypts it\r\n * \r\n * @param {*} fileName \r\n * the encrpyted file \r\n * @param {*} key \r\n * the decryption key\r\n *\/\r\nconst readFileEncrypted = (fileName, key) => {\r\n try {\r\n \/\/ resolve the filepath\r\n const filePath = path.resolve(fileName);\r\n\r\n \/\/ use openssl to decrypt the keys\r\n return exec(`openssl enc -d -aes-256-cbc -k \"${key}\" -in \"${filePath}\"`, \r\n (error, stdout) => {\r\n if (error) {\r\n console.error(`exec error: ${error}`);\r\n }\r\n return stdout;\r\n });\r\n } catch (error) {\r\n console.error(error);\r\n return undefined;\r\n }\r\n};\r\n\r\n\/\/ the password (stored in environment)\r\nconst password = process.env.PASSWORD_KEYFILES;\r\nif (!password) {\r\n console.error('Environment Variable \"PASSWORD_KEYFILES\" is not set.');\r\n process.exit(1);\r\n}\r\n\r\n\/\/ load the keys & certificates\r\nconst rootCertificate = readFileEncrypted('.\/app\/certs\/ca.crt.enc', password);\r\nconst clientCertificate = readFileEncrypted('.\/app\/certs\/domino-express.crt.enc', password);\r\nconst clientKey = readFileEncrypted('.\/app\/certs\/domino-express.key.enc', password);\r\n\r\n\/\/ check if the keys are ok \r\nif (!rootCertificate || !clientCertificate || !clientKey) {\r\n console.error('Unable to load certificates and\/or key.');\r\n process.exit(1);\r\n}\r\n\r\nconst Config = {\r\n serverConfig: {\r\n hostName: process.env.NODE_ENV === 'development' ? 'dev.example.com' : 'example.com', \/\/ Host name of your server\r\n connection: {\r\n port: '3002', \/\/ Proton port on your server\r\n secure: true,\r\n }, \r\n credentials: {\r\n rootCertificate,\r\n clientCertificate,\r\n clientKey,\r\n },\r\n },\r\n databaseConfig: {\r\n filePath: 'testnode.nsf', \/\/ The database file name\r\n }\r\n};\r\n\r\nmodule.exports = Config;\r\n<\/code><\/pre>\nconst password = process.env.PASSWORD_KEYFILES;<\/code><\/pre>\ndocker run -e \"PASSWORD_KEYFILES=0123456789\"<\/strong> --name dominoexpress -p 3000:3000 -d -it shasselba\/domino-express<\/code><\/pre>\n{\r\n \"version\": \"0.2.0\",\r\n \"configurations\": [\r\n {\r\n \"type\": \"node\",\r\n \"request\": \"launch\",\r\n \"name\": \"Programm starten\",\r\n \"program\": \"${workspaceFolder}\/app\/bin\/www\",\r\n \"env\": {\"PASSWORD_KEYFILES\": \"0123456789\"}<\/strong>\r\n },\r\n ]\r\n}<\/code><\/pre>\n