search

shinken-solutions / shinken

Flexible and scalable monitoring framework
http://www.shinken-monitoring.org
GNU Affero General Public License v3.0
1.13k stars 335 forks source link

shinken install insecurely downloads packages #1601

Open leoluk opened 9 years ago

leoluk commented 9 years ago

shinken install downloads unsigned code over an unencrypted connection (https://github.com/naparuba/shinken/blob/e636db2c1768c38ffcfda0f019b1bb789d4fdbf0/cli/shinkenio/cli.py#L325).

This allows an attacker to compromise a Shinken host by adding malicious code to a downloaded package.

Enabling HTTPS for shinken.io would mitigate this - a proper fix would be the implementation of package signing.

Seb-Solon commented 9 years ago

+1. signature and https are always great to have.