TLS certificate with hardcoded private key in postgres Docker Hub image

[hannob]

I checked a couple of top images on Docker Hub for pregenerated / hardcoded private keys and noted that the "postgres" images (which is a "Docker Official Image") contain a pregenerated "snakeoil" certificate and private key:

/etc/ssl/private/ssl-cert-snakeoil.key
/etc/ssl/certs/ssl-cert-snakeoil.pem

Those snakeoil certs are autogenerated by Debian, but they are not supposed to be hardcoded. Instead, keys should be generated
on instantiating a container from an image.

The security risk is somewhat limited, as the postgres image does not appear to directly enable TLS, so the certificate is not used in the default configuration. It is however referenced in the config file postgresql-common/root.crt, so it looks like it could easily get enabled and used.

(I reported this to Docker's security contact, but was asked to report it here due to the low security risk. More generally, I think it's worth considering having some safeguards against this for all Docker images, e.g., by auto-scanning them for common pregenerated key paths. But not sure if this is the right place to discuss this.)

[tianon]

Good catch! I don't think these are terribly important (either from a security perspective or from a usage perspective). 👍

IMO it isn't worth generating them at container runtime, given their limited usefulness (and it definitely doesn't seem worth replicating the behavior on Alpine 😂), but I'm open to being wrong. 🙇

I looked at src:ssl-cert that's creating these and unfortunately I don't see a simple toggle to prevent them from being generated at all, so I guess deleting them after they're generated is the best we can do? 😞

[hannob]

Yes, I think deleting the cert+key (and simply not having it in the image) is fine. My sentence regarding generating it on instantiation of the container was more broadly referring to "for containers where a cert is needed". Given that in the default config for this image, it's not needed, I guess it's fine to not have it to begin with.