K3os: Security vulnerability: Password login is enabled on the ssh server

[majkrzak]

I've recently encountered major security flaw in the k3os configuration. By default ssh accepts the password login to the rancher user.

[ibuildthecloud]

For security issue please send to [email protected].

Can you further explain what the issue is? If you boot k3os live from the ISO the password is hardcoded to "rancher" and SSH will accept the login. For an installed system the password should be what you have set it to, either ssh key or password.

Is your issue regarding the live CD or an installed system?

[majkrzak]

Technically both, cause ssh server accepts the password login by default, so you are able to login with both ssh key or password.

[dweomer]

@majkrzak this can be easily overridden with either a run_cmd kernel parameter or entry in the config.yaml

kernel param: run_cmd="echo PasswordAuthentication no >> /etc/ssh/sshd_config"

that said, it might make more sense to flip the default behavior to turn off password auth without an explicit kernel param or config.yaml entry