4 ms·

Yet another reason not to use images provided by your hosting company. In anycase, if you are relying on hosting company images (complete with their root backd

by zx2c4 11y ago

Yet another reason not to use images provided by your hosting company. In anycase, if you are relying on hosting company images (complete with their root backdoor for "performance monitoring control panel!"), it's not like you care very much about your servers' security in the first place...

Ded7xSEoPKYNsDd 11y ago
If you really believe your hosting provider puts root backdoors in your systems, you really shouldn't run anything in a hypervisor controlled by them.
- TimWolla 11y ago
  http://help.ovh.com/InstallOVHkey http://help.ovh.com/InstallOVHkey > In order to be able to intervene on your dedicated server without your root password, the automatic installation of ssh key is done. Only authorized employees of OVH will use it. It is not a gap in security, contrary, thanks to this OVH has root rights to your server and may identify the problems with your server. When you request an intervention, we need to have access to ssh.
  - mschuster91 11y ago
    Sounds to me like what is needed for a managed root-server. Actually it's kinda cool because you can enjoy timely upgrades, security fixes and response to ddos attacks while at the same time you also have the flexibility to install needed software without going through a change request workflow...
  - pquerna 11y ago
    A SSH private key is just some bytes. Once you have access to it, you have access to it forever in the future. RSA doesn't care if you are an "authorized employee". A static SSH key for a single human is already risky over a long time period, but for a key that is shared between multiple humans... wow.
  - niij 11y ago
    This is an opt-in process, not an opt-out. They don't have authorized keys on your server by default, only instructions to add them if needed.
    - Wilya 11y ago
      Unless it has changed recently, it's opt-out. The instructions are mostly for re-adding the key if you have removed it.
dozzie 11y ago
> Yet another reason not to use images provided by your hosting company. Wait, you mean you clone your images instead of installing them from scratch with some automated system? How barbarous!
otterley 11y ago
It's not as though it's impossible to make a secure image. Mistakes can and do happen, though. Better to own up to it and fix it than to hide the problem.

by zx2c4 11y ago

Ded7xSEoPKYNsDd 11y ago

If you really believe your hosting provider puts root backdoors in your systems, you really shouldn't run anything in a hypervisor controlled by them.

TimWolla 11y ago
http://help.ovh.com/InstallOVHkey http://help.ovh.com/InstallOVHkey > In order to be able to intervene on your dedicated server without your root password, the automatic installation of ssh key is done. Only authorized employees of OVH will use it. It is not a gap in security, contrary, thanks to this OVH has root rights to your server and may identify the problems with your server. When you request an intervention, we need to have access to ssh.
- mschuster91 11y ago
  Sounds to me like what is needed for a managed root-server. Actually it's kinda cool because you can enjoy timely upgrades, security fixes and response to ddos attacks while at the same time you also have the flexibility to install needed software without going through a change request workflow...
- pquerna 11y ago
  A SSH private key is just some bytes. Once you have access to it, you have access to it forever in the future. RSA doesn't care if you are an "authorized employee". A static SSH key for a single human is already risky over a long time period, but for a key that is shared between multiple humans... wow.
- niij 11y ago
  This is an opt-in process, not an opt-out. They don't have authorized keys on your server by default, only instructions to add them if needed.
  - Wilya 11y ago
    Unless it has changed recently, it's opt-out. The instructions are mostly for re-adding the key if you have removed it.

dozzie 11y ago

> Yet another reason not to use images provided by your hosting company. Wait, you mean you clone your images instead of installing them from scratch with some automated system? How barbarous!

otterley 11y ago

It's not as though it's impossible to make a secure image. Mistakes can and do happen, though. Better to own up to it and fix it than to hide the problem.