0

If two persons are pulling the same docker image (let's say Debian:10.4), they will obtain the same "files" (layers) from the docker repo.

So, from what I understand, launching a docker image is not exactly like a fresh install, it is more like a preinstalled OS. So I guess the two docker images debian:10.4 launched in two separate hosts should be as equivalent as possible to avoid difference in the behaviour from a host to another.

Considering this, I am asking myself if the root's password is always the same on every debian:10.4 images.

I don't know if we know the root's password of this image or only the hash. But if someone could find a preimage of this hash, he would be able to log in in every SSH server based on a debian:10.4 ?

Or is there a minimal randomness applied at the start of a instance docker to ensure the dispersion of some security constant (root password, id_rsa key, ...) ?

Improve this question
3
  • I guess the root password is never set
    – nobody
    Commented Jul 27, 2020 at 13:27
  • 2
    You could easily answer this question by checking /etc/shadow on one or more of your containers.
    – multithr3at3d
    Commented Jul 27, 2020 at 15:53
  • Yeah I did it, and you're right: on ubuntu and debian, the password is not set. So I'm asking myself if a malicious one could be interested by publishing a image with an hardcoded root password. If the container will later expose some service to Internet (where root can authenticate), it could act as a backdoor
    – Sibwara
    Commented Jul 28, 2020 at 9:57

1 Answer 1

Reset to default
2

Docker containers don't usually let you log in as root with any password. Usually, the only way to get in is to docker exec from the host. There is no hash to find a preimage of.

Improve this answer
2
  • Yes you seems to be right. Could it be interesting for a malicious person to create a docker image, let's say a mysql caontainer, with a secret admin for whom he knows the password. So he will be able to connect on every instance of this docker available from Internet (ok I know there should not be so many internet face mysql services)
    – Sibwara
    Commented Jul 28, 2020 at 9:54
  • @Sibwara No, that wouldn't make any sense to do. Docker containers generally don't have SSH running or exposed whether or not they're Internet-facing. Also, it would be easier to just put the malicious payload in the container.
    – Joseph Sible-Reinstate Monica
    Commented Jul 28, 2020 at 13:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .