The default cloud-init configuration, in cloud-init 0.6.2 and newer, included ssh_deletekeys: 0, disabling cloud-inits deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cloud-init | Canonical | 0.6.2 | * |