TLS private key and certificate are compiled into the binary and published in the repo ai:claude-opus-5-5 #3

New issue

Open

opened 2026-10-29 15:02:03 +01:00 by heiko · 0 comments

heiko commented

2026-10-29 15:02:03 +01:00

Owner

(co)authored by ai:claude-opus-5-5

Found while preparing the public software pages for www.schlittermann.de (static review, not a full audit).

cmd/nrpe/key.go contains a PEM PRIVATE KEY, crt.go the matching certificate. cmd/nrpe/listener.go loads exactly this pair with tls.X509KeyPair([]byte(CRT), []byte(KEY)).

Impact: every installation uses the same publicly known key. TLS therefore gives no protection against an active attacker and no server authentication.

Proposal:

make certificate and key configurable (nrpe.cfg options or a path), read from a file with sane permissions;
or generate a per-installation key/certificate at first start;
remove the embedded key from the repo (it stays in git history; treat it as compromised);
document the limitation in the README until fixed.

The website page for go-nrpe currently only says that TLS "uses a built-in certificate".

(co)authored by ai:claude-opus-5-5 Found while preparing the public software pages for www.schlittermann.de (static review, not a full audit). `cmd/nrpe/key.go` contains a PEM `PRIVATE KEY`, `crt.go` the matching certificate. `cmd/nrpe/listener.go` loads exactly this pair with `tls.X509KeyPair([]byte(CRT), []byte(KEY))`. **Impact:** every installation uses the same publicly known key. TLS therefore gives no protection against an active attacker and no server authentication. **Proposal:** - make certificate and key configurable (`nrpe.cfg` options or a path), read from a file with sane permissions; - or generate a per-installation key/certificate at first start; - remove the embedded key from the repo (it stays in git history; treat it as compromised); - document the limitation in the README until fixed. The website page for go-nrpe currently only says that TLS "uses a built-in certificate".

heiko added the

security

label

2026-10-29 15:09:50 +01:00