CVE-2014-125030: Use of Hard-coded Credentials (CWE-798)
value: A vulnerability, which was classified as critical, has been found in taoeffect Empress. Affected by this issue is some unknown functionality. The manipulation leads to use of hard-coded password. The patch is identified as 557e177d8a309d6f0f26de46efb38d43e000852d. It is recommended to apply a patch to fix this issue. VDB-217154 is the identifier assigned to this vulnerability.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 9.8
Published: 2023-01-01T09:15Z
Repository: https://github.com/taoeffect/empress
Language: YAML
Files changed: Vagrantfile, roles/common/handlers/main.yml, roles/common/tasks/security.yml, roles/ssh/README.md, roles/ssh/handlers/main.yml, roles/ssh/tasks/main.yml, site.yml, test.yml, vars/testing.yml
Commit date: 2014-12-02 19:10:52 -0500
Commit message: Add digitalocean as a provider for vagrant

I've got a slow-ass laptop, so deploying to digitalocean is faster, and
cheap enough that I don't care.

This sets some default passwords, which makes the box vulnerable, but
the machine is short-lived and has no sensitive information so it
shouldn't matter. Long-term, this should be fixed somehow.

Diff: diff --git a/Vagrantfile b/Vagrantfile
index 52b4b29..de6ebef 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -7,27 +7,39 @@ Vagrant.configure("2") do |config|
 
   config.vm.hostname = "empress.local"
   config.vm.network "private_network", ip: "172.16.100.2"
 
   config.vm.provision :ansible do |ansible|
-    ansible.playbook = "site.yml"
+    ansible.playbook = "test.yml"
     ansible.host_key_checking = false
-    ansible.extra_vars = { ansible_ssh_user: "vagrant", testing: true }
+    ansible.extra_vars = { testing: true }
 
     # ansible.tags = ["blog"]
     # ansible.skip_tags = ["openvpn"]
-    # ansible.verbose = "vvvv"
+    ansible.verbose = "vvvv"
   end
 
   config.vm.provider :virtualbox do |v|
     v.memory = 256
   end
 
   config.vm.provider :vmware_fusion do |v|
     v.vmx["memsize"] = "256"
   end
 
+  config.vm.provider :digital_ocean do |provider, override|
+    override.ssh.private_key_path = "~/.ssh/id_rsa"
+    override.vm.box = "digital_ocean"
+    override.vm.box_url = "https://github.com/smdahlen/vagrant-digitalocean/raw/master/box/digital_ocean.box"
+
+    provider.ssh_key_name = "TODO"
+    provider.token = "TODO"
+    provider.image = "debian-7-0-x64"
+    provider.region = "nyc3"
+    provider.size = "512mb"
+  end
+
   #
   # vagrant-cachier
   #
   # Install the plugin by running: vagrant plugin install vagrant-cachier
   # More information: https://github.com/fgrehm/vagrant-cachier
diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml
index 3ca3bcf..0ca56bd 100644
--- a/roles/common/handlers/main.yml
+++ b/roles/common/handlers/main.yml
@@ -4,8 +4,5 @@
 - name: restart ntp
   service: name=ntp state=restarted
 
 - name: restart fail2ban
   service: name=fail2ban state=restarted
-
-- name: restart ssh
-  service: name=ssh state=restarted
diff --git a/roles/common/tasks/security.yml b/roles/common/tasks/security.yml
index f665b16..e73ca1d 100644
--- a/roles/common/tasks/security.yml
+++ b/roles/common/tasks/security.yml
@@ -13,9 +13,5 @@
   copy: src=etc_fail2ban_filter.d_dovecot-pop3imap.conf dest=/etc/fail2ban/filter.d/dovecot-pop3imap.conf
   notify: restart fail2ban
 
 - name: Ensure fail2ban is started
   service: name=fail2ban state=started
-
-- name: Update sshd config to disallow root logins
-  lineinfile: dest=/etc/ssh/sshd_config regexp=^PermitRootLogin line="PermitRootLogin no" state=present
-  notify: restart ssh
diff --git a/roles/ssh/README.md b/roles/ssh/README.md
new file mode 100644
index 0000000..25f7c2f
--- /dev/null
+++ b/roles/ssh/README.md
@@ -0,0 +1,8 @@
+empress.ssh
+===========
+
+Disables ssh `root` login. This improves security, but may get in the way if you
+aren't using a `deploy` user.
+
+Eventually, this should provide a number of common configurable tweaks for ssh,
+like disabling password auth.
diff --git a/roles/ssh/handlers/main.yml b/roles/ssh/handlers/main.yml
new file mode 100644
index 0000000..9b95e27
--- /dev/null
+++ b/roles/ssh/handlers/main.yml
@@ -0,0 +1,3 @@
+---
+- name: restart ssh
+  service: name=ssh state=restarted
diff --git a/roles/ssh/tasks/main.yml b/roles/ssh/tasks/main.yml
new file mode 100644
index 0000000..42e95b2
--- /dev/null
+++ b/roles/ssh/tasks/main.yml
@@ -0,0 +1,4 @@
+---
+- name: Update sshd config to disallow root logins
+  lineinfile: dest=/etc/ssh/sshd_config regexp=^PermitRootLogin line="PermitRootLogin no" state=present
+  notify: restart ssh
diff --git a/site.yml b/site.yml
index 2274df0..b66bdd4 100644
--- a/site.yml
+++ b/site.yml
@@ -5,12 +5,13 @@
   user: deploy
   sudo: True
   gather_facts: True
   vars_files:
     - vars/defaults.yml
-    - vars/{{ 'testing' if testing is defined else 'user' }}.yml
+    - vars/user.yml
 
   roles:
     - common
     - mailserver
+    - ssh
     - tarsnap
     # - mailpile # fix this
diff --git a/test.yml b/test.yml
new file mode 100644
index 0000000..cf9bece
--- /dev/null
+++ b/test.yml
@@ -0,0 +1,18 @@
+---
+# Installs all the stuff that makes sense to use together for testing purposes
+# eventually we may want to have multiple implementations of this to test common
+# setups, eg. different vagrant configs for different sql backends.
+
+- hosts: all
+  # user should be defined by vagrant
+  sudo: True
+  gather_facts: True
+  vars_files:
+    - vars/defaults.yml
+    - vars/testing.yml
+
+  roles:
+    - common
+    - mailserver
+    - tarsnap
+    # - mailpile # fix this
diff --git a/vars/testing.yml b/vars/testing.yml
index a6546cc..3a66dc4 100644
--- a/vars/testing.yml
+++ b/vars/testing.yml
@@ -3,10 +3,11 @@
 # Variables used when testing with Vagrant
 # For a complete reference look at the `vars/defaults.yml` file.
 ###############################################################################
 
 # common
+testing: true
 domain: empress.local
 main_user_name: empress
 timezone: America/Los_Angeles
 
 friendly_networks:

Vulnerable code:     ansible.playbook = "site.yml"
    ansible.extra_vars = { ansible_ssh_user: "vagrant", testing: true }
    # ansible.verbose = "vvvv"

- name: restart ssh
  service: name=ssh state=restarted

- name: Update sshd config to disallow root logins
  lineinfile: dest=/etc/ssh/sshd_config regexp=^PermitRootLogin line="PermitRootLogin no" state=present
  notify: restart ssh
    - vars/{{ 'testing' if testing is defined else 'user' }}.yml
Fixed code:     ansible.playbook = "test.yml"
    ansible.extra_vars = { testing: true }
    ansible.verbose = "vvvv"
  config.vm.provider :digital_ocean do |provider, override|
    override.ssh.private_key_path = "~/.ssh/id_rsa"
    override.vm.box = "digital_ocean"
    override.vm.box_url = "https://github.com/smdahlen/vagrant-digitalocean/raw/master/box/digital_ocean.box"

    provider.ssh_key_name = "TODO"
    provider.token = "TODO"
    provider.image = "debian-7-0-x64"
    provider.region = "nyc3"
    provider.size = "512mb"
  end

empress.ssh
===========

Disables ssh `root` login. This improves security, but may get in the way if you
aren't using a `deploy` user.

Eventually, this should provide a number of common configurable tweaks for ssh,
like disabling password auth.
---
- name: restart ssh
  service: name=ssh state=restarted
---
- name: Update sshd config to disallow root logins
  lineinfile: dest=/etc/ssh/sshd_config regexp=^PermitRootLogin line="PermitRootLogin no" state=present
  notify: restart ssh
    - vars/user.yml
    - ssh
---
# Installs all the stuff that makes sense to use together for testing purposes
# eventually we may want to have multiple implementations of this to test common
# setups, eg. different vagrant configs for different sql backends.

- hosts: all
  # user should be defined by vagrant
  sudo: True
  gather_facts: True
  vars_files:
    - vars/defaults.yml
    - vars/testing.yml

  roles:
    - common
    - mailserver
    - tarsnap
    # - mailpile # fix this
testing: true