Enum AdministrativeSecretHandling

pub enum AdministrativeSecretHandling {
    Plaintext,
    SystemdCreds,
    ShamirsSecretSharing,
}

The handling of administrative secrets.

Administrative secrets may be handled in different ways (e.g. persistent or non-persistent).

Variants

Plaintext

The administrative secrets are handled in a plaintext file in a non-volatile directory.

Warning

This variant should only be used in non-production test setups, as it implies the persistence of unencrypted administrative secrets on a file system.

SystemdCreds

The administrative secrets are handled in a file encrypted using systemd-creds in a non-volatile directory.

Warning

This variant should only be used in non-production test setups, as it implies the persistence of (host-specific) encrypted administrative secrets on a file system, that could be extracted if the host is compromised.

ShamirsSecretSharing

The administrative secrets are handled using Shamir’s Secret Sharing (SSS).

This variant is the default for production use, as the administrative secrets are only ever exposed on a volatile filesystem for the time of their use. The secrets are only made available to the system as shares of a shared secret, split using SSS. This way no holder of a share is aware of the administrative secrets and the system only for as long as it needs to use the administrative secrets.

Trait Implementations

impl Clone for AdministrativeSecretHandling

fn clone(&self) -> AdministrativeSecretHandling

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AdministrativeSecretHandling

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AdministrativeSecretHandling

fn default() -> AdministrativeSecretHandling

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AdministrativeSecretHandling

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for AdministrativeSecretHandling

fn eq(&self, other: &AdministrativeSecretHandling) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for AdministrativeSecretHandling

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for AdministrativeSecretHandling

impl Eq for AdministrativeSecretHandling

impl StructuralPartialEq for AdministrativeSecretHandling