Rules / GL047

GL047 SSH connection to remote host as root user

Severity: warn
OWASP: CICD-SEC-7 – Insecure System Configuration
CWE: CWE-250 – Execution with Unnecessary Privileges

Risk

Connecting to a remote server as root from a CI job grants full, unrestricted access to the target host. If the pipeline is compromised — via a supply-chain attack, variable injection, or a malicious dependency — the attacker gains root access to production infrastructure, not just the CI runner. This amplifies the blast radius far beyond the pipeline environment.

What is flagged

Script lines (in script:, before_script:, after_script:, or a run: step) that invoke ssh with root as the login user, in any common form:

ssh root@host
ssh -i key root@host
ssh -p 2222 root@host
ssh -o StrictHostKeyChecking=no root@host
ssh root@$DEPLOY_HOST

Trigger example

deploy:
  script:
    - ssh root@$PRODUCTION_HOST "cd /app && git pull && systemctl restart app"

Safe alternative

Create a dedicated service account on the target host with access limited to exactly the operations needed:

deploy:
  script:
    - ssh deploy@$PRODUCTION_HOST "cd /app && git pull && systemctl restart app"

Configure the deploy user with sudoers access restricted to the specific commands required (e.g. NOPASSWD: /usr/bin/systemctl restart app). Use a short-lived SSH key stored as a masked, protected CI/CD variable.

Notes

• The rule matches ssh ... root@ regardless of flags or options between ssh and the username
• Only root@ is flagged; root appearing elsewhere (e.g. in the hostname: ssh deploy@rootserver.example.com) does not trigger the rule

Documentation for glsec 1.23.0. Source of this page · Rule implementation