Golang SSH Security

Re:Golang SSH Security by eropple on Saturday April 15, 2017 @03:32PM (#14122405)

I am...not a fan of Golang, as I have made pretty clear around here on occasion. But I'll give credit where credit's due, and this is a good decision on the part of the people maintaining x/crypto/ssh. Not the tooling vendor's awful response--I'm pretty sure I know who it is, and if not there's two of 'em because I've had these conversations before--but the maintainers are doing the right thing. This probably shouldn't have gotten out the door without host key verification in the first place (and that ties back into the reasons why I do not like or trust Golang or its community when it comes to tools that I have to consume), but it's better to bite the bullet and fix this now instead of letting it fester.

(The "PGP is too hard for discussing security issues" thing, though, is total nonsense. Can't be doing that.)

[ Parent | on HN ]

Re:Golang SSH Security by grey-area on Saturday April 15, 2017 @03:49PM (#14122481)

Doesn't the writer call out hashicorp specifically by name in the article?

I used to respect this vendor and recommend their tools to others. I am having to rethink this a lot. I am no longer happy to recommend Hashicorp products to others.

[ Parent | on HN ]

Re:Golang SSH Security by eropple on Saturday April 15, 2017 @03:54PM (#14122504)

Oh, ha, I glazed over that paragraph! But yeah, it was totally Hashicorp I was thinking about; this sort of reliability-thoroughly-optional thing shoots through a lot of their tools and keeps me pretty far away from any of the ones that might touch live environments. (Packer and Vagrant are fine.)

[ Parent | on HN ]

Re:Golang SSH Security by RRRA on Saturday April 15, 2017 @05:22PM (#14122930)

Which one of their tools are we talking about here? Terraform?

[ Parent | on HN ]

Re:Golang SSH Security by mitchellh on Saturday April 15, 2017 @06:15PM (#14123142)

I posted the exact affected software (and how) here: https://news.ycombinator.com/item?id=14122973 I go into detail so I'd rather not repeat it here :)

[ Parent | on HN ]

Re:Golang SSH Security by syscomet on Saturday April 15, 2017 @06:11PM (#14123129)

blog-post author here: all of them written in Golang which use SSH.

Packer, Terraform, Vault, all of them.

Using a bastion host in your configurations doesn't help if you invoke the tooling on your laptop, since the connection to the bastion host is done with the SSH package, again with no host-key verification.

[ Parent | on HN ]

Re:Golang SSH Security by Piphe on Saturday April 15, 2017 @08:07PM (#14123594)

And Vault is supposed to be a super secure root of trust. Hmm...

[ Parent | on HN ]

Re:Golang SSH Security by canes123456 on Monday April 24, 2017 @01:09PM (#14186008)

Damn, I was planning on using Vault eventually. This attitude towards security gives me pause about put all my secrets into it. Is there any alternatives?

[ Parent | on HN ]