to ec2-user or not to ec2-user?
Garrett Holmstrom
gholms at fedoraproject.org
Sat Dec 15 02:27:41 UTC 2012
On Fri, Dec 14, 2012 at 1:00 PM, Jay Greguske <jgregusk at redhat.com> wrote:
> On 12/14/2012 03:12 PM, Matthew Miller wrote:
>> Amazon recommends using ec2-user (with passwordless sudo) for EC2 images.
>> That's what Fedora has been doing. Do we want to continue this? Arguments:
>>
>>
>> A. It doesn't really provide any added security, but does add complication.
>> Additionally, normal "don't run as root" advice is less important since
>> cloud instances should be ephemeral and recreatable.
>>
>> B. But, consistency.
>
> Fedora can of course do its own thing, but Ubuntu, Amazon Linux, future
> RHELs, and other distros use ec2-user. This lines up with the EC2
> documentation as well. I'd discourage changing it just because we can.
Some historical info: since our first cloud image targeted EC2, we
looked at the EC2 documentation and other distros, most of which
tended toward ec2-user, so we went with that.
>> What's our SIG consensus here?
>>
>> Other points:
>>
>> - We're making images for EC2 and for other cloud systems as well.
>> 'ec2-user' seems particularly silly on, say, OpenStack.
>> - We could use ec2-user and something else (including just root) on the
>> generic images.
>
> Fair points.
If we end up with One Image to Rule Them All at some point, I think
using something more generic is fair. We could probably get pretty
close with some fine-tuning. Just not for F18; I suspect we're a
little late for that kind of churn.
>> - We should decide this really fast because it's already past the last
>> minute; default is to just stay with ec2-user for F18 and revisit for
>> F19.
>>
>
> +1
+1. This is an excellent time to discuss plans for F19 images, not so
much F18 images.
--
Garrett Holmstrom
More information about the cloud
mailing list