search

cirros-dev / cirros

116 stars 33 forks source link

Disable login with password! #98

Open modyngs opened 1 year ago

modyngs commented 1 year ago

Hi I've been using cirros as an Entrypoint to some of openstack's VM (VNFs) using SSH and it is great. Thanks to the dev team! But there might be some Risky ( hazardous ) situations when login with Password is Enabled ( like bruteforce ).

I've always used keypair for SSH login ( ssh -i A.pem user@IP ) and changed the default password, But i'm not sure if there is a way to disable logging in with password for root/user?

P.S: I'm using Cloud image 

wget http://download.cirros-cloud.net/0.5.1/cirros-0.5.1-x86_64-disk.img
openstack image create --disk-format qcow2 --container-format bare --public --file cirros-0.5.1-x86_64-disk.img  cirros

Thanks Best regards

osfrickler commented 1 year ago

CirrOS is meant to be a test image to be used in a CI environment or similar, so the fixed login via a password is a feature. We explicitly state that it should not be deployed anywhere where there is public access. Seems for you use case some other distro would be more suited, have you looked at alpine maybe?

modyngs commented 1 year ago

@osfrickler Dear Jens, Thanks for the reply but Non of the other distros has the cloud image in size of the CirrOS { small in size } I dont mean the whole login process gets disabled but the SSH login with password which is commonly available in the ssh config file(Its an option in the ssh config file that can be disabled or not).

The cirros uses dropbear, it has the option to disable pasword login for remote connections. but it doesnt work! $ dropbear -h

Best regards

modyngs commented 1 year ago

Is there anyway that "JUST authorized_keys" be able to login? ( Not any other ways, including passwords login , ...) {this option is available in CirrOS, but login with password is also possible!!!__ i dont want that}

priteau commented 6 months ago

@osfrickler We have a similar use case: we use CirrOS for validating OpenStack with Tempest. On some deployments we have to use networks exposed to the Internet. I would be great if the CirrOS project would publish an alternative version of the image with no password built-in.

modyngs commented 6 months ago

@priteau Have you found a way to do that? Thanks