Skip to content

Should store GitHub host pubkey in container instead of insecurely fetching through the network #22

@bwbuchanan

Description

@bwbuchanan

This container currently uses ssh-keyscan to fetch the host key for the WP Engine SSH server before attempting to connect.

This is insecure and defeats the entire purpose of having a host key to authenticate the server.

I suggest that instead you hardcode WP Engine's SSH host public key(s) into the container, so that SSH will fail if someone is performing a man-in-the-middle-attack against the connection.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions