diff options
| author | Ryan Lue <hello@ryanlue.com> | 2022-06-30 23:04:35 -0700 |
|---|---|---|
| committer | Lukas Fleischer <lfleischer@calcurse.org> | 2023-04-11 15:22:03 -0400 |
| commit | e772c4b6d52627c463e70b4284e3794aa0bd0634 (patch) | |
| tree | ea1962c737cac208ab8c8b034bde22b8cc3e32d1 /contrib/caldav/README.md | |
| parent | 4cd300f2c408907b4a576b55fc15479afbd5d81f (diff) | |
| download | calcurse-e772c4b6d52627c463e70b4284e3794aa0bd0634.tar.gz calcurse-e772c4b6d52627c463e70b4284e3794aa0bd0634.zip | |
calcurse-caldav: Support PasswordCommand option
This commit adds a new `Auth/PasswordCommand` option
to support security best practices re: handling secrets
in CLI program configuration.
Prior to this commit, the two available options
for specifying a password were:
1. via the `Auth/Password` config parameter, or
2. via a `$CALCURSE_CALDAV_PASSWORD` environment variable.
The former is unsafe for obvious reasons;
the latter is unsafe because as long as the script is running,
its environment can be accessed via
$ cat /proc/<pid>/environ
and is thus visible to anyone with access to the system.
This commit preserves preexisting behavior (for backward compatibility)
but removes all mention of option 2 from the README.
Since the README example for option 2 used a password command anyway,
there is little reason to continue its use,
and this commit recommends it be deprecated.
Signed-off-by: Lukas Fleischer <lfleischer@calcurse.org>
Diffstat (limited to 'contrib/caldav/README.md')
| -rw-r--r-- | contrib/caldav/README.md | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/contrib/caldav/README.md b/contrib/caldav/README.md index a842081..b464dc9 100644 --- a/contrib/caldav/README.md +++ b/contrib/caldav/README.md @@ -34,13 +34,12 @@ argument. You can choose between the following initialization modes: For subsequent calcurse-caldav invocations, you don't need to specify any additional parameters. -You can specify a username and password for basic authentication in the -config file. Alternatively, the password can be passed securely from another -program (such as *pass*) via the `CALCURSE_CALDAV_PASSWORD` environment variable like -so: -``` -CALCURSE_CALDAV_PASSWORD=$(pass show calcurse) calcurse-caldav -``` +Specify your HTTP Basic authentication credentials under the config file's +`Auth` section. The most secure approach is to save your password in a CLI +encrypted password store (_e.g.,_ [pass](https://www.passwordstore.org/)), and +then set `PasswordCommand` to the shell command used to retrieve it. +If security is not a priority, you may store your password in plain text +instead. Hooks ----- |