search

aws / amazon-ssm-agent

An agent to enable remote management of your EC2 instances, on-premises servers, or virtual machines (VMs).
https://aws.amazon.com/systems-manager/
Apache License 2.0
1.06k stars 326 forks source link

RPM Not Signed #28

Closed ferricoxide closed 6 years ago

ferricoxide commented 7 years ago

Wanted to start playing with the SSM agent for our EL7-based builds. However, our EL7 builds security requirements (per DISA STIG-ID RHEL-07-020150 and SRG-OS-000366-GPOS-00153) state that all RPMs must be signed by a trusted authority. Upon attempting to install the SSM agent per the documentation, yum fails with a Package amazon-ssm-agent.rpm is not signed.

While this can be worked around by adding --nogpgcheck to the yum-invocation:

  1. Many of our DevOps-enabled programs are light on EL-specific expertise and won't know to do this
  2. Many who do know to do this will be reluctant to do it as it would potentially be construed as "circumvention".
  3. Enterprise CM tools may automatically/summarily remove any unsigned RPMs that are installed - breaking workflows that are created to depend on the agent.

In short, all AWS-furnished RPMs (that are called out in the docs.aws.amazon.com-hosted URLs) should probably be signed (and a trusted signing-key's public-key be published).

shihuazhang commented 7 years ago

Thanks for your feedback ferricoxide,

The team is aware of this issue and will address it for the next release

lorengordon commented 7 years ago

@shihuazhang there have been a couple releases since the issue was opened. Is the rpm signed now?

redbaron commented 7 years ago

Please provide signed RPM or at least signed checksums file on S3 bucket.

shihuazhang commented 7 years ago

Hi @lorengordon and @redbaron
Thanks for your feedback, we currently have the work item tracked internally, I will let the team know and having the ECD provided here.

ferricoxide commented 7 years ago

@shihuazhang any updates? A little less than two months till we hit this issue's anniversary-date and nearly a quarter since your last comment.

mmendonca3 commented 7 years ago

We acknowledge your request but we do not have a date for this on our road-map. We will continue tracking it closely.

edelkind commented 6 years ago

It's strange and a little disconcerting that this is proving so difficult to implement. If Amazon said, "We think that https should be enough for anyone, and have no plans to implement this, ever," then i'd feel better about that response (hopefully coupled with doc updates) than about the acknowledgement and ensuing inactivity.

ferricoxide commented 6 years ago

@edelkind except that, since that isn't really the point of signing an RPM, it would be a bit disappointing to see such a response.

I mean, this would make a degree of sense if the underlying reason for the delay were that they don't currently have the infrastructure and/or process in place for managing signing-keys ...but if that were the case, I'd want to see that reason at least offered (and possibly some kind of tracking-info for that effort that we'd hopefully be able to follow).

FilBot3 commented 6 years ago

Isn't there an AWS provided GPG signing key for their RPM's and such?

nehalaws commented 6 years ago

Thank you for posting the issue, this is still item in our backlog and we don't have a date yet for when it will be completed

ferricoxide commented 6 years ago

@nehalaws

I'm confused: you seem to be saying the issue hasn't been resolved but you're still closing the issue??

emyglobal commented 4 years ago

Are we going to continue a workaround by introducing a security hole? Is this GPG Key available for this rpm? YET?

ferricoxide commented 4 years ago

@emyglobal certainly seems that way...

Are we going to continue a workaround by introducing a security hole?

eramos-ce commented 7 months ago

8 years and this issue is still unresolved. This should be taken into consideration to maintain accreditation for clients requiring SSM connectivity.