Description
After installation or cloning from an image, every secret that is the same on other systems must be replaced: passwords set by the installer or a template, SSH host keys copied with the image, default application passwords, and self-signed certificates shipped by packages.
Rationale
Systems built from the same image share their secrets. An attacker who extracts one of them, or reads the vendor documentation, can reuse it everywhere the image was deployed.
Impact
Regenerating SSH host keys changes their fingerprints: clients must accept the new ones.
Audit
- Compare the SSH host key fingerprints (
ssh-keygen -lf /etc/ssh/ssh_host_*_key.pub) with other systems built from the same image. They must differ. - Check that the passwords of the accounts created by the installer or the image were changed.
- List the applications with default credentials (databases, web consoles) and confirm they were changed.
Remediation
- Regenerate SSH host keys:
rm /etc/ssh/ssh_host_*thendpkg-reconfigure openssh-server. - Set new passwords for the accounts created by the image, or lock them.
- Change application default passwords and replace snakeoil certificates
(
make-ssl-cert generate-default-snakeoil --force-overwrite, or real certificates).
References
- ssh-keygen(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R51) ANSSI, guide, accessed 2026-10-18
Mappings
| Framework | ID | Relation |
|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R51 | equivalent |
| NIST SP 800-53 Rev. 55.1.1 | IA-5 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
