Juju deployments allow remote SSH access with hard-coded password

Just confirmed this behavior with local provider.

For public and private clouds we utilize the official ubuntu cloud images which have password auth disabled.

In the lxc case we do setup a user ubuntu with a disabled password and i see code to disable password auth against the ssh server, but clearly there's an issue preventing that in practice.

This is somewhat mitigated by the lack of remote network access afforded by local provider.

However its still a rather serious issue. Thank you for bringing it to our attention

confirmed specific to the local provider and not remotely accessible. the lxc container customization was disabling root logins but not password auth.

also fwiw i tracked down the origin of that user/password combo to the default lxc package ubuntu template. juju creates the user with a disabled password if it doesn't exist.

fix is on trunk, daily ppa will rebuild, this will get rolled into precise proposed, and security pockets for oneiric and precise.

this issue should probably also be fixed in the lxc package ubuntu template since its setting up the default/known username passwords. the fix for juju is to just disable the password auth for ssh.

Sounds like this bug can be made public then, since the commits are public.

Excerpts from Jamie Strandboge's message of 2012-06-22 19:55:20 UTC:
> Sounds like this bug can be made public then, since the commits are
> public.

I think so. Its a really low risk vulnerability. You have to try really
hard to make it remote-exploitable, and juju is basically just not safe
on multi user systems at all anyway.

"juju is basically just not safe on multi user systems at all anyway"

Information like this really needs to go in the docs... what are the issues?

Excerpts from Thomas Leonard's message of 2012-06-25 08:06:17 UTC:
> "juju is basically just not safe on multi user systems at all anyway"
>
> Information like this really needs to go in the docs... what are the
> issues?
>

First line of https://juju.ubuntu.com/docs

"Note juju is still in a stage of fast development, and is not yet ready
for prime time. The current software is being made available as an early
technology preview, and while it can be experimented with, it should
not be used in real deployments just yet."

This bug was fixed in the package juju - 0.5+bzr531-0ubuntu1.3

---------------
juju (0.5+bzr531-0ubuntu1.3) precise-security; urgency=low

  * SECURITY UPDATE: d/p/upstream-543.patch: Disable password authentication
    on LXC containers created in the local provider. (LP: #1016428)
  * SECURITY UPDATE: d/p/upstream-564.patch: Fix example mysql charm to
    not expose root mysql password to all users. (LP: #1040165)
  * SECURITY UPDATE: d/p/upstream-565.patch: Verify charm store hostname
    matches hostname on SSL certificate. (LP: #992447)
 -- Clint Byrum <email address hidden> Thu, 23 Aug 2012 17:12:26 -0700