From: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
To: openembedded-core@lists.openembedded.org
Cc: Qi.Chen-CWA4WttNNZF54TAoqtyWWQ@public.gmane.org
Subject: Re: [PATCH 9/9] Generate ssh keys at rootfs creation time in case of a read-only rootfs
Date: Fri, 26 Jul 2013 12:39:12 +0200 [thread overview]
Message-ID: <lyk3kdk3lb.fsf@ensc-virt.intern.sigma-chemnitz.de> (raw)
In-Reply-To: <5dc3be245a9757c51dadd7ce446c5116ce79496d.1374642547.git.Qi.Chen@windriver.com> (Qi's message of "Fri, 26 Jul 2013 15:39:36 +0800")
<Qi.Chen-CWA4WttNNZF54TAoqtyWWQ@public.gmane.org> writes:
> To avoid generating ssh keys every time a system with read-only rootfs
> starts, we generate ssh keys at rootfs creation time.
This is security wise a very bad and dangerous change because all devices
will get the same key which can be extracted very easy from (public)
images.
Enrico
next prev parent reply other threads:[~2013-07-26 10:39 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-26 7:39 [PATCH 0/9] Make read-only rootfs work well with live images Qi.Chen
2013-07-26 7:39 ` [PATCH 1/9] init-live.sh: make $ROOT_MOUNT/media writable when necessary Qi.Chen
2013-07-26 7:39 ` [PATCH 2/9] use a uniform way to determine whether rootfs is read-only Qi.Chen
2013-07-26 7:39 ` [PATCH 3/9] udev: remove implicit dependency on initscripts Qi.Chen
2013-07-26 7:39 ` [PATCH 4/9] populate-volatile.sh: use $ROOT_DIR/var/volatile/tmp as TMPDIR Qi.Chen
2013-07-26 7:39 ` [PATCH 5/9] runqemu-internal: fix to start X correctly in live images Qi.Chen
2013-07-26 7:39 ` [PATCH 6/9] initscripts: use a uniform way to handle directories in read-only rootfs Qi.Chen
2013-07-26 7:39 ` [PATCH 7/9] irda-utils: make /etc/sysconfig writable " Qi.Chen
2013-07-26 7:39 ` [PATCH 8/9] lighttpd: make /www diretory " Qi.Chen
2013-07-26 7:39 ` [PATCH 9/9] Generate ssh keys at rootfs creation time in case of a " Qi.Chen
2013-07-26 9:28 ` Martin Jansa
2013-07-26 9:52 ` Phil Blundell
2013-07-26 11:08 ` Mike Looijmans
2013-07-26 11:22 ` Burton, Ross
2013-07-26 10:39 ` Enrico Scholz [this message]
2013-07-29 1:55 ` ChenQi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lyk3kdk3lb.fsf@ensc-virt.intern.sigma-chemnitz.de \
--to=enrico.scholz@sigma-chemnitz.de \
--cc=Qi.Chen-CWA4WttNNZF54TAoqtyWWQ@public.gmane.org \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox