Hacker News

points by hnfong 2 days ago | 0 comments

Alpine Linux (which uses musl) images are popularly deployed by those who use docker, and apparently the issue is there on the default install.

Not sure whether the PHP vulnerability actually had been exploited, but I'm pretty sure there are literally thousands of machines out there affected by this ssh issue right now as we speak.

This isn't going to end well.

---

Addendum (which may or may not be related to the above) --

Everyone has heard of the tale of the boy who cried wolf. The main moral of the story is not to troll your fellow townsfolks so they don't distrust you. But everyone with a sane mind gets that.

The (IMHO) under-appreciated lesson is actually: don't be those villagers. Believe stories you are given, even if you might look like a fool for believing in them. Don't assume what happens is the same as what happened in the past. Look at the facts yourself. Trust and verify.

[–] VorpalWay 2 days ago

You don't typically run sshd in containers, instead you only run whatever single service you set up your container for.

Sure there are native Alpine installs too, but that is far less common of a use case.

[–] tonnydourado 2 days ago

Who's out there running sshd inside a docker container? It's almost MORE work than exec-ing into the container.

[–] hylaride 2 days ago

I've done it in the past with "serverless" sftp servers, which is how a lot of inter-company batch transfers happen for historical reasons, especially in the financial sector. I don't recall what images I used, but it was far easier to patch with a CI/CD pipeline. We did use keys, though.

[–] cluckindan 2 days ago

Probably a lot of companies which have their own k8s cluster and segregate kubectl access to operations only. Developers still need a way to their app backend in some cases.

[–] chuckadams 2 days ago

Kubernetes already comes with better solutions for that sort of thing. I could see a ssh bastion container for bridging to legacy infrastructure though. Manage its keys right and it's probably more secure than a lot of alternatives.

[–] jbvlkt 2 days ago

Even if you do that why would you allow it outside VPN?

[–] cluckindan 1 day ago

You wouldn’t, but it would still remain an avenue for lateral movement

[–] zbentley 2 days ago

Several CICD solutions which offer "shell into container to debug a build failure".

You'd think they'd all do the smart thing and exec a shell into the container's namespace. You'd be wrong.

[–] Jolter 2 days ago

I have done that in the past, in order to be able to automate copying files to the container during testing or data migration. It was an ugly hack and now I need to make double sure none of those containers are still running…

[–] Brian_K_White 2 days ago

Everyone who has access to their container and not the host except by some terrible vnc or web console.

[–] andix 2 days ago

Alpine in containers is usually not affected. Most images/containers haven't ssh/sshd installed at all. Remote access is usually done from the host system.

[–] 63stack 2 days ago

You could start with trust and verifying what you wrote first, the popular usage of alpine in docker containers don't run sshd.

[–] hnfong 2 days ago

Even if 0.1% of those machines run sshd I guesstimate we'd still be talking thousands.