September 15, 2017

Safer Packer Examples with SSH

—How to avoid Vagrant's public SSH key pair.

It's a little unsettling to see Packer template files with a clear text password for the vagrant user and root embedded within. Some template authors tell you to delete the vagrant user account if the virtual machine is publicly accessible. Still it's cringe worthy.

In my experiments with Packer I decided to script away some of this cringe worthiness. I took the position that I can improve upon the situation if I

generate my own SSH key pair,
lockout the vagrant user account so that only SSH access is possible using my key, and
encrypt the root password file in the kickstart and preseed files on CentOS, Debian and Fedora.

This isn't perfect but it mitigates the above points as follows:

avoids the use of the vagrant insecure public key.
avoids the use of common words and phrases in example passwords.
limits root password exposure.

As an added benefit, any examples that accidentally make it into production are more secure because the passwords and SSH keys are generated when the Vagrant Boxes are built.

The basic strategy I used to achieve the above is embedded within makefile.credentials. Credentials are generated by default, but can easily be manually created. Credentials are used by the Packer Temple files and a script for generating a Preseed Configuration file.

These examples use Debian but there are Fedora and CentOS examples as well.