wpengine / wpengine/site-deploy
Should store GitHub host pubkey in container instead of insecurely fetching through the network
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 6
- Forks
- 4
- Avg merge
- 1m
- Merged PRs (30d)
- 3
Description
This container currently uses ssh-keyscan to fetch the host key for the WP Engine SSH server before attempting to connect.
This is insecure and defeats the entire purpose of having a host key to authenticate the server.
I suggest that instead you hardcode WP Engine's SSH host public key(s) into the container, so that SSH will fail if someone is performing a man-in-the-middle-attack against the connection.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by locating where the container invokes ssh-keyscan for the WP Engine SSH server, then determine how the host public key is supplied during the image build and connection. Done means the expected key is stored in the container and a mismatched server key causes SSH to fail.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- shell
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100