Undocumented credentials part of the code in repository (D@rj33l1ng)

[dragetd]

There are default-credentals in the code with the password 'D@rj33l1ng' configured here:
https://github.com/boxcutter/windows/blob/72c70ff96bc4a1fe1f2b6802c8d8839230f1450b/floppy/_packer_config.cmd#L47
https://github.com/boxcutter/windows/blob/72c70ff96bc4a1fe1f2b6802c8d8839230f1450b/floppy/_packer_config.cmd#L48

here:
https://github.com/boxcutter/windows/blob/72c70ff96bc4a1fe1f2b6802c8d8839230f1450b/floppy/cygwin.bat#L22

and here:
https://github.com/boxcutter/windows/blob/72c70ff96bc4a1fe1f2b6802c8d8839230f1450b/floppy/openssh.bat#L8

First of all, the README could have a warning in the next update that states this fact and reminds people who are running these boxes to check if they have these default credentials enabled, since this password should be declared 'insecure' now.

The long-term solution might be a configuration variable to set all credentials across spots, where this is needed.

For now, the password could be set to a less surprising value like 'boxcutter' and be clearly documented in the README, so poeple are at least aware of this.

Replacing these and adding a bit to the README is a #goodfirstissue :-)

[daxgames]

The long-term solution might be a configuration variable to set all credentials across spots, where this is needed.

FWIW Thats what this is, just remove the :: and set a different password:

https://github.com/boxcutter/windows/blob/72c70ff96bc4a1fe1f2b6802c8d8839230f1450b/floppy/_packer_config.cmd#L48

[dragetd]

Well, the issue that this is not very well documented still stands.

[daxgames]

True

[arizvisa]

Thanks for this report. I don't personally use the ssh+cygwin builders, so this is a great catch. I'll see what I can do once I make some progress on the other things.

If you want to update the docs or anything in the meantime, a PR would be very welcomed.