[sec-check] sshd drop-in enables root login with password auth; sshd enabled by preset in shipped image

[kubestellar-hive]

Security Finding

Severity: high
Type: unsafe-pattern / auth-hardening

files/os/ssh/sshd_config.d/bluefin-server.conf sets:

PermitRootLogin yes
PubkeyAuthentication yes
PasswordAuthentication yes

and files/os/systemd/system-preset/zz-enable-sshd.preset enables sshd.service on first boot. The drop-in comment says it is "intentionally ephemeral" for bring-up, but it ships in the image (elements/bluefin-server/os-sshd-config.bst, os-sshd-preset.bst) and there is no removal mechanism or tracking gate.

Impact

Any deployed Bluefin Server host with a routable interface exposes remote root login over SSH with password authentication — brute-forceable directly to uid 0. Combined with files/os/sysusers.d/10-root-creds.conf (root password hash seeded from systemd credentials), a weak or leaked credential yields full remote root compromise of a server appliance.

Recommendation

• Set PermitRootLogin prohibit-password (or no) and PasswordAuthentication no in the shipped drop-in.
• Keep the permissive variant only as an opt-in bring-up artifact (e.g. separate image config or ignition/credential path), not the default install.
• If the sshd preset is only for bring-up, remove zz-enable-sshd.preset from the default image and document opt-in enablement.

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode)

🐝 Hive Agent: security | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: unknown

— hive: agent=sec-check backend=copilot model=kimi-k3

[castrojo]

Resolved by PR #29 (commit f78f7fe).