We have a continuous integration server, for which a recent coworker who joined the team has put details (login name and server address) in his public Github repository.
The server ssh configuration only allows public key authentication and the coworker refuses to take down his information from the public Github repo, saying it is not a threat because the security of ssh is good enough.
I know that since we have disabled password authentication, it does not immediately result in a vulnerability, but still I did not want to give a potential adversary the following information:
- The login username on our CI server
- The ip of the CI server itself
- The fact that coworker is using lastpass to store his secret keys
- The fact that he has published his lastpass login address to his public repo itself
(The public repo is basically his configuration repo which he uses to set up his machine).
Since he refused to take down the info, I proposed to at least make sure that our CI server is behind a VPN server and we have done that. However I still believe that it is a violation of security in depth to provide this info to an attacker.
Am I being extra paranoid, or could there be real consequences of having this information publicly available? I am aware that some of this is security through obscurity, but I am thinking it would not hurt hiding this info anyway. I am assuming it could be useful in case of a directed attack, since it gives the attacker some info that he did not probably have access to.