fix: ensure there are no SSH host keys present in the images

Signed-off-by: Damien Duportal <[email protected]>

Author: dduportal

alpine/Dockerfile

@@ -88,7 +88,9 @@ RUN apk add --no-cache \
     musl-locales \
     netcat-openbsd \
     openssh \
-    patch
+    patch \
+  # Cleanup SSH host keys if any
+  && rm -f /etc/ssh/ssh_host*_key*
 
 # setup SSH server
 RUN sed -i /etc/ssh/sshd_config \

debian/Dockerfile

@@ -87,7 +87,10 @@ RUN apt-get update \
         netcat-traditional \
         openssh-server \
         patch \
-    && rm -rf /var/lib/apt/lists/*
+    # Cleanup APT cache
+    && rm -rf /var/lib/apt/lists/* \
+    # Cleanup SSH host keys if any
+    && rm -f /etc/ssh/ssh_host*_key*
 
 # setup SSH server
 RUN sed -i /etc/ssh/sshd_config \

tests/sshAgent.Tests.ps1

@@ -86,6 +86,23 @@ Describe "[$global:IMAGE_NAME] image has setup-sshd.ps1 in the correct location"
     }
 }
 
+Describe "[$global:IMAGE_NAME] image has no pre-existing SSH host keys" {
+    BeforeAll {
+        $exitCode, $stdout, $stderr = Run-Program 'docker' "run --detach --tty --name=`"$global:CONTAINERNAME`" --publish-all `"$global:IMAGE_NAME`" `"$global:CONTAINERSHELL`""
+        $exitCode | Should -Be 0
+        Is-ContainerRunning $global:CONTAINERNAME | Should -BeTrue
+    }
+
+    It 'has has no SSH host key present in C:\ProgramData\ssh' {
+        $exitCode, $stdout, $stderr = Run-Program 'docker' "exec $global:CONTAINERNAME $global:CONTAINERSHELL -C `"if(Test-Path C:/ProgramData/ssh/ssh_host*_key*) { exit 0 } else { exit 1 }`""
+        $exitCode | Should -Be 1
+    }
+
+    AfterAll {
+        Cleanup($global:CONTAINERNAME)
+    }
+}
+
 Describe "[$global:IMAGE_NAME] checking image metadata" {
     It 'has correct volumes' {
         $exitCode, $stdout, $stderr = Run-Program 'docker' "inspect --format '{{.Config.Volumes}}' $global:IMAGE_NAME"

tests/tests.bats

@@ -52,6 +52,17 @@ docker_run_opts=('--detach' '--publish-all' '--health-cmd=echo | nc -w1 localhos
   clean_test_container "${test_container_name}"
 }
 
+@test "[${SUT_IMAGE}] image has no pre-existing SSH host keys" {
+  local test_container_name=${AGENT_CONTAINER}-ssh-hostkeys
+  clean_test_container "${test_container_name}"
+  docker run --name="${test_container_name}" --name="${test_container_name}" "${docker_run_opts[@]}" "${PUBLIC_SSH_KEY}"
+
+  run docker exec "${test_container_name}" ls -l /etc/ssh/ssh_host*_key*
+  assert_failure
+
+  clean_test_container "${test_container_name}"
+}
+
 @test "[${SUT_IMAGE}] create agent container with pubkey as argument" {
   local test_container_name=${AGENT_CONTAINER}-pubkey-arg
   clean_test_container "${test_container_name}"

windows/nanoserver/Dockerfile

@@ -124,7 +124,8 @@ RUN [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tl
     Add-Content -Path "C:\ProgramData\ssh\sshd_config" -Value ('Match User {0}' -f $env:JENKINS_AGENT_USER) ; `
     Add-Content -Path "C:\ProgramData\ssh\sshd_config" -Value ('       AuthorizedKeysFile C:/Users/{0}/.ssh/authorized_keys' -f $env:JENKINS_AGENT_USER) ; `
     New-Item -Path HKLM:\SOFTWARE -Name OpenSSH -Force | Out-Null ; `
-    New-ItemProperty -Path HKLM:\SOFTWARE\OpenSSH -Name DefaultShell -Value 'C:\Program Files\Powershell\pwsh.exe' -PropertyType string -Force | Out-Null
+    New-ItemProperty -Path HKLM:\SOFTWARE\OpenSSH -Name DefaultShell -Value 'C:\Program Files\Powershell\pwsh.exe' -PropertyType string -Force | Out-Null ; `
+    Remove-Item -Path "C:\ProgramData\ssh\ssh_host*_key*
 
 COPY CreateProfile.psm1 C:/
 

windows/windowsservercore/Dockerfile

@@ -110,7 +110,8 @@ RUN [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tl
     Add-Content -Path "C:\ProgramData\ssh\sshd_config" -Value ('Match User {0}' -f $env:JENKINS_AGENT_USER) ; `
     Add-Content -Path "C:\ProgramData\ssh\sshd_config" -Value ('       AuthorizedKeysFile C:/Users/{0}/.ssh/authorized_keys' -f $env:JENKINS_AGENT_USER) ; `
     New-Item -Path HKLM:\SOFTWARE -Name OpenSSH -Force | Out-Null ; `
-    New-ItemProperty -Path HKLM:\SOFTWARE\OpenSSH -Name DefaultShell -Value 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -PropertyType string -Force | Out-Null
+    New-ItemProperty -Path HKLM:\SOFTWARE\OpenSSH -Name DefaultShell -Value 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -PropertyType string -Force | Out-Null ; `
+    Remove-Item -Path "C:\ProgramData\ssh\ssh_host*_key*"
 
 COPY CreateProfile.psm1 C:/