d4d26a6ba2
This commit addresses security concerns from the OWASP audit by enforcing strict host key verification for all SSH and SCP commands. Key changes: - Replaced StrictHostKeyChecking=accept-new with yes in pkg/container and pkg/devops. - Removed insecure host key verification from pkg/ansible SSH client. - Implemented a synchronous host key discovery mechanism during VM boot using ssh-keyscan to populate ~/.core/known_hosts. - Updated the devops Boot lifecycle to wait until the host key is verified. - Ensured pkg/ansible correctly handles missing known_hosts files. - Refactored hardcoded SSH port 2222 to a package constant DefaultSSHPort. - Added CORE_SKIP_SSH_SCAN environment variable for test environments. |
||
|---|---|---|
| .. | ||
| templates | ||
| container.go | ||
| hypervisor.go | ||
| hypervisor_test.go | ||
| linuxkit.go | ||
| linuxkit_test.go | ||
| state.go | ||
| state_test.go | ||
| templates.go | ||
| templates_test.go | ||