Report privately via GitHub Security Advisories. Please do not open a public issue for a security problem.
Expect an acknowledgement within a few days. This is maintained by one person in their own time, so please be patient with the fix timeline; the acknowledgement will be honest about it.
The latest minor release. There are no long-term support branches.
This tool authenticates to every host in a fleet with a privileged account and writes files that execute at login. The interesting risks are:
Credential handling. Passwords travel via stdin or environment, never argv, because
/proc is world-readable and ps would show them to every local user. They are never
written to reports, JSON output, or the run log.
The login path. The renderer executes on every SSH session. A bug there affects every
automated job in the fleet at once. The generated profile.d hook must remain silent in
non-interactive shells; without that, scp, sftp and rsync are corrupted fleet-wide.
Changes to those guards are treated as security-relevant.
Untrusted host output. Values collected from a target are attacker-influenced if that host is compromised. They are treated as data everywhere:
- Rendered through
printf '%s', never as a format string, so a hostname containing%ncannot do anything. - Written to xlsx reports as text with formula prefixes (
=,+,-,@) escaped, so a hostname cannot become a formula that fires when the report is opened. - The on-target cache is parsed with a key whitelist rather than sourced, so a corrupted or
tampered
facts.envcannot execute anything.
Disclosure. The MOTD is shown to anyone who authenticates, including a compromised low-privilege account. Failed unit names, internal addressing, patch deficits and audit failure counts are useful reconnaissance, so each is individually toggleable.
The pre-auth banner (/etc/issue, /etc/issue.net) is shown to anyone who can reach the
port at all. It uses a separate template whose loader rejects every host, system and
package field by name. That restriction is enforced at load time, not by convention, and a
change that weakens it is a security bug.
- Compromise of the control node running the tool.
- A host that is already root-compromised reporting false facts about itself.
- Anything requiring the operator's SSH credentials to already be known.