5 ms·

I'm still trying to wrap my head around DigitalOcean emailing me the root password to my new instances.

• voltagex_ 10y ago
  If you specify a keypair to be used, they won't do that.
  • hoodoof 10y ago
    The correct solution is to display it to the user on an HTTPS page.
    • sophacles 10y ago
      Why do you think this is more correct than the user providing the public side of an ssh key pair?
• noja 10y ago
  If DigitalOcean and your mail server both talk TLS, what's the problem?
  • bigiain 10y ago
    Some random old bit of Cisco gear sitting anywhere in between with it's default configuration set to strip out STARTTLS commands... http://www.cisco.com/c/en/us/about/security-center/intelligence/asa-esmtp-starttls.html http://www.cisco.com/c/en/us/about/security-center/intellige... "When Cisco ASA is configured for ESMTP inspection, the ASA is not able to examine the TLS session because it is encrypted. Therefore the ASA will prevent the establishment of the STARTTLS session and allow the SMTP endpoints to determine whether the SMTP session should continue in clear text (that is, with no privacy)." (I once billed a client just over $30k to investigate/diagnose/resolve that problem - there was a piece of Cisco gear on the edge of their network that nobody ever admitted to even knowing existed which was stripping out the STARTTLS instruction between a webapp running inside their own datacenter and their own 3rd party mail service - and everybody was pointing their fingers at _me_ for the mail not coming through encrypted... Twitch. Twitch. Twitch...)
    • noja 10y ago
      Ah. So we need more of that Postini option to require STARTTLS is successful.
  • hoodoof 10y ago
    The problem is that email is insecure. It isn't good security practice to send root passwords over email under any circumstances.