SECURITY: user admin password admin in the images
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 3.9k
- Forks
- 230
- Avg merge
- 7h 48m
- Merged PRs (30d)
- 3
Description
Hi,
I was using an image derivated of "nestybox/ubuntu-jammy-systemd-docker:latest".
But I discovered that someone was entering in my docker images with ssh installing cryptocurrency zombies.
I discovered a user admin in all images in the production sites.
I tracked where this user came from and I got to this file:
https://github.com/nestybox/dockerfiles/blob/master/ubuntu-jammy-systemd/Dockerfile
There a user admin with password admin.
I would like to know if it is a good practice and if this password is needed or could I delete?
Best regards,
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading ubuntu-jammy-systemd/Dockerfile, especially the admin user and password setup described in the report. Confirm whether that account is required, then build the affected image and verify that the resulting image no longer exposes an unnecessary default credential.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100