[task][vm] add remote host to ssh known hosts

[pducolin]

What does this PR do?

Add newly created host to known_hosts file at create-vm time

Which scenarios this will impact?

VMs

Motivation

Required for ADXT-690, as we want less interactions as possible to quickly set up a remote VM for windows development

Additional Notes

Tested it locally:

1. Create a VM on aws

inv aws.create-vm --no-install-agent

2. Verified that I could connect without being prompted to add the remote host to known hosts, and that ~/.ssh/known_hosts contained my new host

# known_hosts content
...
10.1.57.39 ssh-rsa <public key>
10.1.57.39 ecdsa-sha2-nistp256 <public key>
10.1.57.39 ssh-ed25519 <public key>

3. Destroyed the VM

inv aws.destroy-vm

4. Verified that ~/.ssh/known_hosts did not contain my remote host anymore

# known_hosts content
...

[datadog-datadog-prod-us1]

🟠 Code Vulnerability

Check command call and ensure there is no unsanitized data used. The variable `stackName` may need to be validated (...read more)

In Go, the exec.Command function is used to run external commands. Using this function carelessly can lead to command injection vulnerabilities.

Command injection occurs when untrusted input is passed directly to a system shell, allowing an attacker to execute arbitrary commands. This can result in unauthorized access to the system, data leaks, or other security breaches.

To prevent command injection vulnerabilities when using exec.Command in Go, follow these coding best practices:

1. Sanitize User Input: Always validate and sanitize user inputs before passing them to exec.Command. Avoid executing commands constructed using user-provided data.
2. Avoid using Shell Expansion: If possible, pass the command and arguments as separate strings to exec.Command. This prevents the shell from interpreting special characters in a potentially malicious way.
3. Use Absolute Paths: When specifying the command to be executed, use absolute paths for executables whenever possible. This reduces the risk of inadvertently running a similarly named malicious command from the system's PATH.
4. Avoid String Concatenation: Refrain from dynamically constructing commands by concatenating strings. Instead, use the arg ...string parameter of exec.Command to pass arguments safely.
5. Limit Privileges: Run commands with the least privilege required to carry out the task. Avoid running commands with elevated privileges unnecessarily.

By following these practices, you can reduce the risk of command injection vulnerabilities when using exec.Command in Go and enhance the security of your application.

    

[datadog-datadog-prod-us1]

🟠 Code Vulnerability

Check command call and ensure there is no unsanitized data used. The variable `stackName` may need to be validated (...read more)

In Go, the exec.Command function is used to run external commands. Using this function carelessly can lead to command injection vulnerabilities.

Command injection occurs when untrusted input is passed directly to a system shell, allowing an attacker to execute arbitrary commands. This can result in unauthorized access to the system, data leaks, or other security breaches.

To prevent command injection vulnerabilities when using exec.Command in Go, follow these coding best practices:

1. Sanitize User Input: Always validate and sanitize user inputs before passing them to exec.Command. Avoid executing commands constructed using user-provided data.
2. Avoid using Shell Expansion: If possible, pass the command and arguments as separate strings to exec.Command. This prevents the shell from interpreting special characters in a potentially malicious way.
3. Use Absolute Paths: When specifying the command to be executed, use absolute paths for executables whenever possible. This reduces the risk of inadvertently running a similarly named malicious command from the system's PATH.
4. Avoid String Concatenation: Refrain from dynamically constructing commands by concatenating strings. Instead, use the arg ...string parameter of exec.Command to pass arguments safely.
5. Limit Privileges: Run commands with the least privilege required to carry out the task. Avoid running commands with elevated privileges unnecessarily.

By following these practices, you can reduce the risk of command injection vulnerabilities when using exec.Command in Go and enhance the security of your application.

    

[pducolin]

/merge

[dd-devflow]

Devflow running: /merge

View all feedbacks in Devflow UI.

---

2025-01-07 16:04:14 UTC ℹ️ MergeQueue: pull request added to the queue

The median merge time in main is 3m.

---

2025-01-07 16:04:49 UTC ⚠️ MergeQueue: This merge request was unqueued

[email protected] unqueued this merge request

[pducolin]

/merge -c

[pducolin]

/merge

[dd-devflow]

Devflow running: /merge

View all feedbacks in Devflow UI.

---

2025-01-07 16:32:42 UTC ℹ️ MergeQueue: pull request added to the queue

The median merge time in main is 3m.

---

2025-01-07 16:34:35 UTC ℹ️ MergeQueue: This merge request was merged