Improve password posture

[ay901246]

Rev 2

Realized there might be backwards compatibility issues if we remove password auth entirely; going to remove that change since the new password should be very secure anyway.

Password Generation Enhancements (AutomationHelpers.psm1)

• Transitioned from the legacy Get-Random method to [System.Security.Cryptography.RandomNumberGenerator]::Create() for a more robust and modern source of entropy.
• Optimized performance and memory management by instantiating the generator and byte array outside of the while loop, reducing unnecessary garbage collector pressure.

---

SSH Configuration Updates (BOSH.SSH.psm1)

• Updated Edit-DefaultOpenSSHConfig with a regex replacement to ensure PasswordAuthentication is explicitly set to no.
• This standardizes the authentication flow by enforcing key-based access for the Administrator account over SSH.

---

Test Suite Improvements (AutomationHelpers.Tests.ps1 & BOSH.SSH.Tests.ps1)

• Replaced static hardcoded mocks (e.g., 'changeMe123!') with dynamic evaluations of the actual generated output.
• Added test coverage to verify that the generated passwords meet the required length (24 characters) and are unique on subsequent calls.
• Preserved and updated the 200-attempt loop failure test to ensure it accurately triggers based on the Valid-Password helper.
• Added a dedicated test case to verify the OpenSSH config regex correctly updates the password authentication setting.

Note: Rewrote the Pester tests to evaluate actual string length, validate output uniqueness across subsequent calls, and properly test the 200-attempt loop failure state. SSH config tests have been updated to prove the new regex behaves exactly as intended.

---

Verification

• Executed Pester tests against the modified modules.
• All targeted password generation and SSH validation tests pass successfully.

---

Made-with: Cursor

[ystros]

I don't believe this would be considered a breaking change since users should use bosh ssh for SSH rather than direct password auth.

[Alphasite]

I think this does break using extensions which enable password auth for ssh like os-conf/windows-utilities which has an enable_ssh job

[ay901246]

Removed this.

[Alphasite]

I think that looks ok

[Alphasite]

@coderabbitai review https://github.com/cloudfoundry/bosh-windows-stemcell-builder/pull/166/changes

[Copilot]

Pull request overview

Improves the password-generation implementation in the stemcell automation PowerShell module by switching to a cryptographically secure RNG and updates Pester tests accordingly.

Changes:

• Replaced Get-Random-based password generation with System.Security.Cryptography.RandomNumberGenerator and reused the byte buffer across attempts.
• Updated Pester tests to stop mocking the generated password and to add basic length/uniqueness assertions.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
stembuild/stemcell-automation/AutomationHelpers.psm1	Uses a crypto RNG + byte buffer to generate 24-char passwords in the retry loop.
stembuild/stemcell-automation/AutomationHelpers.Tests.ps1	Adjusts tests for the new generation approach; adds length and uniqueness checks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.