search

mrfixit2001 / debian_desktop

Feature Complete Debian Desktop
74 stars 5 forks source link

[Security Issue] Image do ship `ssh_host_keys` #6

Closed ayufan closed 4 years ago

ayufan commented 5 years ago

It seems that images do ship a number of data that should not be part of:

  1. generated ssh host keys,
  2. a number of /var/log files.

At least the 1. can be considered a security issue and bad practice: https://missingm.co/2013/07/identical-droplets-in-the-digitalocean-regenerate-your-ubuntu-ssh-host-keys-now/ and https://blog.digitalocean.com/avoid-duplicate-ssh-host-keys/.

I also wonder if images were trimmed.

mrfixit2001 commented 5 years ago

ayufan: thank you for pointing these out! They are fixed in the next release, will leave open until I can get that pushed

ayufan commented 5 years ago

Yes, but how you ensure that there are fixed in any future release? :)

Do you have checklist of items to validate before pushing images?

mrfixit2001 commented 5 years ago

Yes :) And I have added the ssh clear and regen into the boot script to run only on first boot.

mrfixit2001 commented 4 years ago

Resolved in latest release