johang/sd-card-images

Images should not come with pre-generated SSH host keys

PieroV opened this issue · 0 comments

PieroV commented

From what I understand, SSH host keys are generated automatically when openssh is installed.
However, this is quite bad, because users might not realize it and use private keys that are not actually private.
I recalled that OpenSSH generated new ones if it couldn't find them, but from a quick search it seems I'm wrong (but I haven't tried, either).
If it doesn't work, I suggest adding a script to do that on the first boot (I can try when I have more time), or at least mention it in the download page, with the other instruction.

That said, these images are great, thanks for this project!