Skip to content

info leak: HPC usernames (zyyu, zyu14) and SetEnv TERM still present in ssh configs — PR #39 regression #49

@stanfish06

Description

@stanfish06

Problem

PR #39 claimed to redact the User zyyu / User zyu14 directives and remove SetEnv TERM=xterm-256color from the SSH configs, but the changes were never applied. Both files still contain the original values on master today (commit f520a40).

ssh/config

hpc/ssh/config

  • User zyyu present for greatlakes

Impact

Anyone who clones the repo can see both HPC usernames. The values are also in git history (noted in PR #39), but leaving them in the live file is unnecessary ongoing exposure.

The SetEnv TERM issue also breaks true-color in any SSH session where the remote sshd_config honours AcceptEnv TERM (it forces xterm-256color instead of tmux-256color, undoing the work from PRs #16/#22).

Fix

PR being opened alongside this issue replaces all User directives with # User <username> placeholders and removes SetEnv TERM=xterm-256color from Host *.

Note: credentials/keys for these accounts should still be rotated, as the values remain in git history.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions