Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Auto-generate SSH/SSL secrets on first boot #39

Open
arm4b opened this issue May 25, 2018 · 1 comment
Open

Auto-generate SSH/SSL secrets on first boot #39

arm4b opened this issue May 25, 2018 · 1 comment
Labels

Comments

@arm4b
Copy link
Member

arm4b commented May 25, 2018

There are concerns about security keys generated during the CI process and so considered insecure.
And while Vagrant is considered as a solution for demo purposes, OVA could be used in prod environments.

The following needs to be auto-generated on first VM boot:

Solution would be systemd configs which rely on ssh/nginx services (runs as "before" dependency) and creates keys/certs if they're not there already.
This will ensure that SSH/SSL secrets are unique and not the same across all the users after our Packer builds.

Apart of that #17, - need to document as insecure:

  • vagrant Linux user with default vagrant password
  • vagrant Linux user with default/known Hashicorp SSH private key
@arm4b arm4b added the security label May 25, 2018
@arm4b
Copy link
Member Author

arm4b commented May 25, 2018

BTW, this issue is actual for any pre-packaged artifact, incl. Docker, see:

https://github.com/StackStorm/st2-docker/blob/d00781776c17e43774940f472fa9929ea432be76/images/stackstorm/Dockerfile#L107-L110

https://github.com/StackStorm/st2-docker/blob/d00781776c17e43774940f472fa9929ea432be76/images/stackstorm/Dockerfile#L127

While it's easy to fix in VM, it'll a bit harder to workaround in Docker.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant