News for hackers. Stuff that matters.

A comment on Golang SSH Security. Parent comment

Re:Golang SSH Security by RRRA on Saturday April 15, 2017 @05:22PM (#14122930)
Which one of their tools are we talking about here? Terraform?
[ Parent | on HN ]
Re:Golang SSH Security by mitchellh on Saturday April 15, 2017 @06:15PM (#14123142)
I posted the exact affected software (and how) here: https://news.ycombinator.com/item?id=14122973 I go into detail so I'd rather not repeat it here :)
[ Parent | on HN ]
Re:Golang SSH Security by syscomet on Saturday April 15, 2017 @06:11PM (#14123129)
blog-post author here: all of them written in Golang which use SSH.

Packer, Terraform, Vault, all of them.

Using a bastion host in your configurations doesn't help if you invoke the tooling on your laptop, since the connection to the bastion host is done with the SSH package, again with no host-key verification.

[ Parent | on HN ]
Re:Golang SSH Security by Piphe on Saturday April 15, 2017 @08:07PM (#14123594)
And Vault is supposed to be a super secure root of trust. Hmm...
[ Parent | on HN ]
Re:Golang SSH Security by canes123456 on Monday April 24, 2017 @01:09PM (#14186008)
Damn, I was planning on using Vault eventually. This attitude towards security gives me pause about put all my secrets into it. Is there any alternatives?
[ Parent | on HN ]