fix(agent/agentssh): pin random seed for RSA key generation

ThomasK33 · ThomasK33 · commit f744aa578572 · 2025-02-19T18:38:51.000+01:00
Change-Id: I8c7e3070324e5d558374fd6891eea9d48660e1e9
Signed-off-by: Thomas Kosiewski &lt;tk@coder.com&gt;
diff --git a/agent/agentssh/agentssh.go b/agent/agentssh/agentssh.go
@@ -3,11 +3,11 @@ package agentssh
 import (
 	"bufio"
 	"context"
-	"crypto/rand"
 	"crypto/rsa"
 	"errors"
 	"fmt"
 	"io"
+	"math/rand"
 	"net"
 	"os"
 	"os/exec"
@@ -115,11 +115,15 @@ func NewServer(ctx context.Context, logger slog.Logger, prometheusRegistry *prom
 	// Clients' should ignore the host key when connecting.
 	// The agent needs to authenticate with coderd to SSH,
 	// so SSH authentication doesn't improve security.
-	randomHostKey, err := rsa.GenerateKey(rand.Reader, 2048)
+
+	// Create a deterministic random source
+	// nolint: gosec
+	deterministicRand := rand.New(rand.NewSource(42))
+	coderHostKey, err := rsa.GenerateKey(deterministicRand, 2048)
 	if err != nil {
 		return nil, err
 	}
-	randomSigner, err := gossh.NewSignerFromKey(randomHostKey)
+	coderSigner, err := gossh.NewSignerFromKey(coderHostKey)
 	if err != nil {
 		return nil, err
 	}
@@ -190,7 +194,7 @@ func NewServer(ctx context.Context, logger slog.Logger, prometheusRegistry *prom
 				slog.Error(err))
 		},
 		Handler:     s.sessionHandler,
-		HostSigners: []ssh.Signer{randomSigner},
+		HostSigners: []ssh.Signer{coderSigner},
 		LocalPortForwardingCallback: func(ctx ssh.Context, destinationHost string, destinationPort uint32) bool {
 			// Allow local port forwarding all!
 			s.logger.Debug(ctx, "local port forward",
