Hacker News Reader

Comment by nivla | Hacker News Reader

Just had it installed. It is much better than the standard log metrics they offer. However what is bothering me is that the whole installation is through a short URL.

curl -s https://lv.linode.com/aBcD | sudo bash

Where aBcD is randomly generated. If you visit https://lv.linode.com/aBcD, it contains not just the script to execute but also your API Key. How safe is it to expose your API Key?

Since the randomly generated value is only 4 characters long, it shouldn't be hard to find other people's API keys by brute forcing it.

View on HN

I added a client, got a shortlink, and checked as well. Then I removed the client and the link persisted for a few minutes (even after clearing cache). Now my link redirects to the error message like your example. Short period, but since there are so few options I would think this is indeed an issue that could be exploited.

Yup it seems the link only persists for a few minutes. But given the knowledge that a lot of people are currently installing longview and that it takes only less than a minute to iterate though all the possible combinations of the 4 character token, it could still be exploitable. They should definitely increase the token length to a safe number.

Exploited how? It's only used to send data in and it should be a pretty simple matter to not accept traffic from multiple machines for one API key. I accidentally used the same shortlink to install on two servers last night and saw a "there are multiple servers sending data, check your configuration" error (while the stats stayed correct).

I believe the fear here is that if you can guess URLs, and one of those URLs works and provides you with a script that contains an API key, you could use that API key to perform other, non-Longview-related API calls to Linode's management API.

That's a pretty decent fear. I don't know if there's any other controls on the API key that prevent it from being as vulnerable as this suggests...

According to Linode support, the API key provided is unique to longview and can't be used for anything else.

It's a different API key for every Longview machine. I set up 3 and the keys are different in each case (which is also why the short URL changes for each machine, the API key is part of the response and is different for each machine).

When I go to https://lv.linode.com/aBcD it shows:

  #!/bin/bash
  echo "Invalid Installer Session"
  echo "Please see the Longview details page to start a new session"
  echo "OR if you would like to install Longview manually please see:"
  echo "http://library.linode.com/longview"

I don't think the OP is going to put his short url which has his API keys.

abcd was just an example they used to show the format. What they said is certainly true.

aBcD was just an example. It would be too risky for me to put the real URL here.

I've tested this and it's a unique Longview API key for the initiation of that installation. This key is not your Linode API key and is disposable.

Reply on news.ycombinator.com