4 ms·
Another, somewhat obvious one: Be extremely careful when using public customized AMIs, a lot of times ~/.ssh/authorized_hosts contains public keys and this is
by misiti3780 11y ago
Another, somewhat obvious one:
Be extremely careful when using public customized AMIs, a lot of times ~/.ssh/authorized_hosts contains public keys and this is obviously a huge security problem
- kbar13 11y agono, public keys are not a security problem.
- joseph 11y agoThey are if you don't know who has the corresponding private key.
- kbar13 11y agooh right when using public AMIs. I thought parent meant publishing AMIs. derp.
- iancarroll 11y agoBut the fact they allow access to your system is.
- mhurron 11y agoPublic keys on your host where you don't control who has the private key are.
- deleted 11y ago[deleted]
- nodesocket 11y agoYeah, I almost feel like AWS should clear the contents of authoried_keys for each user when you make an AMI public. That of course is bound to break some things, but prevents security oversights.
- brianwawok 11y agoI would be more worried about a backdoored sshd in a public ami. At least authorized_keys is a known place to check.