Skip to content

Should store GitHub host pubkey in container instead of insecurely fetching through the network #22

@bwbuchanan

Description

@bwbuchanan

This container currently uses ssh-keyscan to fetch the host key for the WP Engine SSH server before attempting to connect.

This is insecure and defeats the entire purpose of having a host key to authenticate the server.

I suggest that instead you hardcode WP Engine's SSH host public key(s) into the container, so that SSH will fail if someone is performing a man-in-the-middle-attack against the connection.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions