| Summary: | Fully refuse changed hostkeys when StrictHostKeyChecking=no | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | mik | ||||||||||
| Component: | ssh | Assignee: | Damien Miller <djm> | ||||||||||
| Status: | ASSIGNED --- | ||||||||||||
| Severity: | enhancement | CC: | djm, jmknoble, mik | ||||||||||
| Priority: | P5 | ||||||||||||
| Version: | 6.8p1 | ||||||||||||
| Hardware: | All | ||||||||||||
| OS: | All | ||||||||||||
| Bug Depends on: | |||||||||||||
| Bug Blocks: | 3176 | ||||||||||||
| Attachments: |
|
||||||||||||
|
Description
mik
2015-05-18 11:16:35 AEST
From the man page: If this flag is set to “no”, ssh will automatically add new host keys to the user known hosts files. No mention of the HOST_CHANGED behaviour, so even somebody who mostly knows what they're doing is likely to get it wrong. Most people who use this option are better off with certificates now (or StrictHostKeyChecking=yes + ssh-keyscan). Retarget pending bugs to openssh-7.1 Created attachment 2682 [details]
Patch against ssh_config(5)
Retarget to openssh-7.3 Retarget to openssh-7.3 Created attachment 2794 [details]
add StrictHostkeyChecking=accept-new|off
This adds a couple more granular options to StrictHostkeyChecking: "accept-new" (better name wanted) and "off".
StrictHostkeyChecking=off is the current behaviour of "no".
StrictHostkeyChecking=accept-new will accept new hostkeys without prompting but will disconnect for changed hostkeys.
If this goes in then we can make StrictHostkeyChecking=no a synonym for accept-new at some future time (and with forewarning).
Instead of "accept-new", how about "StrictHostkeyChecking=known-only" or "known-hosts" or similar? That is more obvious about which host keys are strict (and "known-hosts" implies the file of a similar name where such keys are stored...). retarget unfinished bugs to next release retarget unfinished bugs to next release retarget unfinished bugs to next release retarget unfinished bugs to next release OpenSSH 7.4 release is closing; punt the bugs to 7.5 Move incomplete bugs to openssh-7.6 target since 7.5 shipped a while back. To calibrate expectations, there's little chance all of these are going to make 7.6. remove 7.5 target Created attachment 3049 [details]
updated to -current
Patch is applied; will be in openssh-7.6 Move to OpenSSH 7.8 tracking bug Created attachment 3159 [details]
flip meaning of StrictHostKeyChecking=no
The only thing remaining in this bug is to change the meaning of StrictHostKeyChecking=no from accepting changed host keys (with restrictions) to refusing them. We'll wait a few more releases before committing this.
Remove release target for now |