StackStorm / packer-st2

Packer templates for building & deploying Vagrant & OVA with StackStorm installed
https://app.vagrantup.com/stackstorm/boxes/st2
Apache License 2.0
14 stars 7 forks source link

Auto-generate SSH/SSL secrets on first boot #39

Open arm4b opened 6 years ago

arm4b commented 6 years ago

There are concerns about security keys generated during the CI process and so considered insecure. And while Vagrant is considered as a solution for demo purposes, OVA could be used in prod environments.

The following needs to be auto-generated on first VM boot:

Solution would be systemd configs which rely on ssh/nginx services (runs as "before" dependency) and creates keys/certs if they're not there already. This will ensure that SSH/SSL secrets are unique and not the same across all the users after our Packer builds.

Apart of that #17, - need to document as insecure:

arm4b commented 6 years ago

BTW, this issue is actual for any pre-packaged artifact, incl. Docker, see:

https://github.com/StackStorm/st2-docker/blob/d00781776c17e43774940f472fa9929ea432be76/images/stackstorm/Dockerfile#L107-L110

https://github.com/StackStorm/st2-docker/blob/d00781776c17e43774940f472fa9929ea432be76/images/stackstorm/Dockerfile#L127

While it's easy to fix in VM, it'll a bit harder to workaround in Docker.