Security updates and graphical control panel improvements

The_Moose

Today we launch a set of security updates, primary targeting the SSH functionality around newly deployed server instances. As well as improved reliability around script execution when using script_url.

Passphrases
One major improvement is the switch from 16 random character passwords to 6 word passphrases, and the switch to a new default ssh user admin, which will be used when logging in with a password/passphrase. The new admin user will have sudo access and can easily switch to the root user after logging in for full root access.

SSH Key tutorial
Authentication by SSH Keys will however still default to the root user. And since SSH Keys is one of the more common questions we get. We've decided to write up a simple tutorial for how to create and use SSH Keys on any system, accessible from dashboard during deployment of new server instances. The tutorial can be found here: https://www.99stack.com/resources/generate-ssh-key-pair

Improved GUI security
On the management page in dashboard, the reinstall button has been moved to the bottom of the page just above the removal button. Both now provides a proper warning dialog with additional information before proceeding. With the SSH password overhaul reinstall now works on G1 and G2 instances again without losing the password. The original default passphrase will be reinstalled.

Upgrade from control panel
Yes, it is now possible to upgrade your server instantly from the graphical control panel with just one click. Do note that because upgrades increase the disk size, it will not be possible to downgrade.

New product pages on main page
On our main website, products are now sorted by category instead of by generation, which makes it a lot easier to browse available server types, and to learn more about their specifications, such as CPU Frequency, GDDR6 memory in a GPU instance, number of disk drives on a multi disk storage server etc.

Boris_Zaitseva

Looks like a copy passphrase button too. 👌 Very convenient and a much smother experience after this update. Good to see you push for increased use of SSH Keys too because that's the safest option.

Frederik_Madsen

This is a welcome update which I wish more providers would consider to implement, the "secure password" myth is infuriating and unfortunately very long lived.

According to https://www.useapassphrase.com, a short password with some characters replaced by special symbols and a mix of upper and lower and a number... you know, what most people would claim is a "secure password" is only 60 times more secure than a more or less common word. That means instead of 10ms it takes a hacker 600ms to brute force your password.

That is frankly ridiculous. But a 4 word passphrase takes on average 6,000,000 centuries to brute force. These 6 word passphrases would take on average 2.16×10²² years to crack, while at the same time being easy to remember.

The_Moose

It has come to our attention that passwords aren't reliably set on distros that doesn't use bash as default shell. Thanks to reports from affected users this has now been patched on G1 and G2. This issue did not affect G3.

Additionally if the user admin still isn't working, the new passphrase is also set on the root user in case no SSH keys are assigned. We've run a lot of tests to make sure it's working properly, but if you run into errors be sure to let us know about which region and image.