4 ms·

Hi there, I originally made this AMI and I would like to apologise to anyone who's instance has been taken offline because they used this image. Through inexpe

Hi there, I originally made this AMI and I would like to apologise to anyone who's instance has been taken offline because they used this image. Through inexperience I left my public SSH key in the AMI, which I failed to appreciate the implications of despite a blog comment highlighting that I'd done so. For the record I'd like to state that I didn't use my unintended powers of root at any point for good or evil. This post stands as a good education of why it's worth checking images of unknown provenance and how to check your public key store for credentials. This issue will mainly affect anyone who wanted an AMI to check out Amazon's free tier which has a 10GB limit on EBS.

whiskers 16y ago
Thanks for the response. If I was building an image for the first time I no doubt could easily make the same mistake. It'll definitely be something I make sure of I ever decide to make my own image in the future.
wladimir 16y ago
Ooops! Hah, that could have happened to me. But it's a good lesson to people to be careful as to what AMI images they use. A SSH key is pretty easy to detect, but malignant people might plant more subtle backdoors.
free 16y ago
I got an email from amazon about this but I just have a couple of sample apps in there.
jerrya 16y ago
I've been looking at EC2 and would probably have used an AMI like yours, if not yours. So, FWIW, talking as an inexperienced n00b... As a suggestions, perhaps an as valuable, if not more valuable, (perhaps more difficult) contribution would a set of scripts that would create such an image. Having the scripts and not the image would allow the many eyes to secure against the pig in a poke while automating image creation. AMIs could then either be created by users themselves wanting to ensure they know exactly what is going on and then uploaded, or, if I understand what you were offering, public/cloneable AMIs could be created at some public gathering and witnessed and checksummed....

whiskers 16y ago

Thanks for the response. If I was building an image for the first time I no doubt could easily make the same mistake. It'll definitely be something I make sure of I ever decide to make my own image in the future.

wladimir 16y ago

Ooops! Hah, that could have happened to me. But it's a good lesson to people to be careful as to what AMI images they use. A SSH key is pretty easy to detect, but malignant people might plant more subtle backdoors.

free 16y ago

I got an email from amazon about this but I just have a couple of sample apps in there.

jerrya 16y ago

I've been looking at EC2 and would probably have used an AMI like yours, if not yours. So, FWIW, talking as an inexperienced n00b... As a suggestions, perhaps an as valuable, if not more valuable, (perhaps more difficult) contribution would a set of scripts that would create such an image. Having the scripts and not the image would allow the many eyes to secure against the pig in a poke while automating image creation. AMIs could then either be created by users themselves wanting to ensure they know exactly what is going on and then uploaded, or, if I understand what you were offering, public/cloneable AMIs could be created at some public gathering and witnessed and checksummed....