<html><body bgcolor="#FFFFFF"><div><br><br>On Nov 18, 2010, at 10:49 AM, Marc Deslauriers <<a href="mailto:marc.deslauriers@canonical.com">marc.deslauriers@canonical.com</a>> wrote:<br><br></div><div><span></span></div><blockquote type="cite"><div><span>Hello,</span><br><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" color="#0023A3"><br></font></font></div></blockquote><blockquote type="cite"><div><blockquote type="cite"><blockquote type="cite"><span></span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>Please consider that the very definition of a "server" implies that</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>the system is running a "service". Moreover, our official Ubuntu</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>Server images as published for the Amazon EC2 cloud are, in fact,</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>running SSH by default listening on port 22 on the unrestricted</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>Internet (the 'ubuntu' has no password), and the Ubuntu Enterprise</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>Cloud installation by the very same ISO installs SSH on every every</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>UEC system deployed. This is not unprecedented.</span><br></blockquote></blockquote><span></span><br><span>As far as I recall, EC2 opens the ssh port from your ip address only,</span><br><span>and authenticates using certificates and not passwords.</span><br><span></span><br></div></blockquote><div><br></div>the default EC2 security group firewalls the machine completely. The user takes explicit action to open port 22 (euca-authorize). the same is true for UEC.<div><br><div><blockquote type="cite"><div><span>Actually, now that you mention it, we should probably disable SSH</span><br><span>password authentication by default in the EC2 images...</span><br></div></blockquote><div><br></div>Instances of the official images have exactly zero users that have a password set. Password auth is allowed, but useless until the user sets a password.</div><div><br></div><div>on boot, the public key specified at launch is pulled from the metadata service and inserted into the 'ubuntu' users authorized keys.</div><div><br></div><div>the corresponding private key is the only way in.</div></div></body></html>