The SSL certificate is the same in any Live box

Bug #337723 reported by Juanje Ojeda on 2009-03-04
254
Affects Status Importance Assigned to Milestone
casper (Guadalinex)
High
Juanje Ojeda
casper (Ubuntu)
High
Unassigned

Bug Description

Binary package hint: casper

The SSL certificate '/etc/ssl/private/ssl-cert-snakeoil.key' is the same in any Ubuntu live system running as far as the key is generated by the package when the filesystem.squashfs is created. And this filesystem.squashfs is the same to all the CDs people download and burn.

This certificate is used by different servers (mail, web, ftp and so) but also is used for browsing over https which could be a security issue if every user use the same ssl certificate that you can get easily from the live cd.

Ubiquity (live-installer) already does it, but the live system doesn't.

This issue happens in Jaunty but is also in the earlier versions.

Juanje Ojeda (juanje) on 2009-03-04
Changed in casper:
assignee: nobody → juanje
importance: Undecided → High
status: New → Fix Committed
Colin Watson (cjwatson) on 2009-03-10
Changed in casper:
status: New → Fix Committed
importance: Undecided → High
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package casper - 1.161

---------------
casper (1.161) jaunty; urgency=low

  [ Juanje Ojeda ]
  * Regenerate SSL certificate at boot so that it isn't the same for all
    live CD users (LP: #337723).

 -- Colin Watson <email address hidden> Tue, 10 Mar 2009 10:39:21 +0000

Changed in casper:
status: Fix Committed → Fix Released
Juanje Ojeda (juanje) on 2009-03-10
Changed in casper:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers