This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-kamelets.git
The following commit(s) were added to refs/heads/main by this push:
new 9a66b0860 Fix #2955: default strictHostKeyChecking to yes and expose
known_hosts configuration (#2967)
9a66b0860 is described below
commit 9a66b08606c61da4c67d77a1510525738b94f3dc
Author: Andrea Cosentino <[email protected]>
AuthorDate: Mon Aug 24 18:40:57 2026 +0200
Fix #2955: default strictHostKeyChecking to yes and expose known_hosts
configuration (#2967)
sftp-sink, sftp-source and scp-sink declared strictHostKeyChecking with a
default of no, so the server host key was accepted without being checked.
Default to yes, constrain the property to yes/no/ask, and add a
knownHostsUri property for deployments with no $HOME/.ssh/known_hosts to
fall back on (useUserKnownHostsFile was already declared and defaults true).
ssh-sink and ssh-source exposed no host-key option at all, and camel-ssh
only installs a verifier when knownHostsResource is set, so host-key
verification was unreachable through the Kamelet interface. Add the
property and bind it.
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
kamelets/scp-sink.kamelet.yaml | 15 +++++++++++++--
kamelets/sftp-sink.kamelet.yaml | 15 +++++++++++++--
kamelets/sftp-source.kamelet.yaml | 15 +++++++++++++--
kamelets/ssh-sink.kamelet.yaml | 8 ++++++++
kamelets/ssh-source.kamelet.yaml | 8 ++++++++
5 files changed, 55 insertions(+), 6 deletions(-)
diff --git a/kamelets/scp-sink.kamelet.yaml b/kamelets/scp-sink.kamelet.yaml
index fd8abc519..3b43e4d85 100644
--- a/kamelets/scp-sink.kamelet.yaml
+++ b/kamelets/scp-sink.kamelet.yaml
@@ -69,9 +69,19 @@ spec:
- urn:camel:group:credentials
strictHostKeyChecking:
title: Strict Host Checking
- description: Sets whether to use strict host key checking.
+ description: Sets whether to use strict host key checking. One of yes,
no or
+ ask. With no, the server host key is accepted without being checked
against
+ a known_hosts entry.
type: string
- default: no
+ enum: ["yes", "no", "ask"]
+ default: "yes"
+ knownHostsUri:
+ title: Known Hosts URI
+ description: The known_hosts file used to verify the server host key,
loaded
+ from the classpath by default. Needed when the process has no
+ $HOME/.ssh/known_hosts to fall back on.
+ type: string
+ pattern: "^(http|https|file|classpath|ref|bean)://.*"
useUserKnownHostsFile:
title: Use User Known Hosts File
description: If knownHostFile has not been explicit configured then
use the host file from System.getProperty(user.home)/.ssh/known_hosts.
@@ -93,4 +103,5 @@ spec:
privateKeyFile: "{{?privateKeyFile}}"
privateKeyPassphrase: "{{?privateKeyPassphrase}}"
strictHostKeyChecking: "{{?strictHostKeyChecking}}"
+ knownHostsUri: "{{?knownHostsUri}}"
useUserKnownHostsFile: "{{?useUserKnownHostsFile}}"
diff --git a/kamelets/sftp-sink.kamelet.yaml b/kamelets/sftp-sink.kamelet.yaml
index 60949d16a..adededd24 100644
--- a/kamelets/sftp-sink.kamelet.yaml
+++ b/kamelets/sftp-sink.kamelet.yaml
@@ -97,9 +97,19 @@ spec:
pattern: "^(http|https|file|classpath|ref|bean)://.*"
strictHostKeyChecking:
title: Strict Host Checking
- description: Sets whether to use strict host key checking.
+ description: Sets whether to use strict host key checking. One of yes,
no or
+ ask. With no, the server host key is accepted without being checked
against
+ a known_hosts entry.
type: string
- default: no
+ enum: ["yes", "no", "ask"]
+ default: "yes"
+ knownHostsUri:
+ title: Known Hosts URI
+ description: The known_hosts file used to verify the server host key,
loaded
+ from the classpath by default. Needed when the process has no
+ $HOME/.ssh/known_hosts to fall back on.
+ type: string
+ pattern: "^(http|https|file|classpath|ref|bean)://.*"
useUserKnownHostsFile:
title: Use User Known Hosts File
description: If knownHostFile has not been explicit configured then
use the host file from System.getProperty(user.home)/.ssh/known_hosts.
@@ -139,6 +149,7 @@ spec:
privateKeyPassphrase: "{{?privateKeyPassphrase}}"
privateKeyUri: "{{?privateKeyUri}}"
strictHostKeyChecking: "{{?strictHostKeyChecking}}"
+ knownHostsUri: "{{?knownHostsUri}}"
useUserKnownHostsFile: "{{?useUserKnownHostsFile}}"
passiveMode: "{{passiveMode}}"
fileExist: "{{fileExist}}"
diff --git a/kamelets/sftp-source.kamelet.yaml
b/kamelets/sftp-source.kamelet.yaml
index 555b9db2e..a409620e2 100644
--- a/kamelets/sftp-source.kamelet.yaml
+++ b/kamelets/sftp-source.kamelet.yaml
@@ -106,9 +106,19 @@ spec:
pattern: "^(http|https|file|classpath|ref|bean)://.*"
strictHostKeyChecking:
title: Strict Host Checking
- description: Sets whether to use strict host key checking.
+ description: Sets whether to use strict host key checking. One of yes,
no or
+ ask. With no, the server host key is accepted without being checked
against
+ a known_hosts entry.
type: string
- default: no
+ enum: ["yes", "no", "ask"]
+ default: "yes"
+ knownHostsUri:
+ title: Known Hosts URI
+ description: The known_hosts file used to verify the server host key,
loaded
+ from the classpath by default. Needed when the process has no
+ $HOME/.ssh/known_hosts to fall back on.
+ type: string
+ pattern: "^(http|https|file|classpath|ref|bean)://.*"
useUserKnownHostsFile:
title: Use User Known Hosts File
description: If knownHostFile has not been explicit configured then
use the host file from System.getProperty(user.home)/.ssh/known_hosts.
@@ -138,6 +148,7 @@ spec:
privateKeyPassphrase: "{{?privateKeyPassphrase}}"
privateKeyUri: "{{?privateKeyUri}}"
strictHostKeyChecking: "{{?strictHostKeyChecking}}"
+ knownHostsUri: "{{?knownHostsUri}}"
useUserKnownHostsFile: "{{?useUserKnownHostsFile}}"
passiveMode: "{{passiveMode}}"
recursive: "{{recursive}}"
diff --git a/kamelets/ssh-sink.kamelet.yaml b/kamelets/ssh-sink.kamelet.yaml
index b423ff114..ef03719af 100644
--- a/kamelets/ssh-sink.kamelet.yaml
+++ b/kamelets/ssh-sink.kamelet.yaml
@@ -60,6 +60,13 @@ spec:
format: password
x-descriptors:
- urn:camel:group:credentials
+ knownHostsResource:
+ title: Known Hosts Resource
+ description: The resource path of a known_hosts file used to verify
the SSH
+ server host key. When not set, the client does not verify the server
host
+ key against a known_hosts file.
+ type: string
+ pattern: "^(http|https|file|classpath|ref|bean):.*"
types:
in:
mediaType: text/plain
@@ -78,3 +85,4 @@ spec:
parameters:
username: "{{username}}"
password: "{{password}}"
+ knownHostsResource: "{{?knownHostsResource}}"
diff --git a/kamelets/ssh-source.kamelet.yaml b/kamelets/ssh-source.kamelet.yaml
index 4dedcdc0d..76be7f3b7 100644
--- a/kamelets/ssh-source.kamelet.yaml
+++ b/kamelets/ssh-source.kamelet.yaml
@@ -61,6 +61,13 @@ spec:
format: password
x-descriptors:
- urn:camel:group:credentials
+ knownHostsResource:
+ title: Known Hosts Resource
+ description: The resource path of a known_hosts file used to verify
the SSH
+ server host key. When not set, the client does not verify the server
host
+ key against a known_hosts file.
+ type: string
+ pattern: "^(http|https|file|classpath|ref|bean):.*"
delay:
title: Delay
description: The number of milliseconds before the next poll
@@ -80,6 +87,7 @@ spec:
parameters:
username: "{{username}}"
password: "{{password}}"
+ knownHostsResource: "{{?knownHostsResource}}"
delay: "{{delay}}"
pollCommand: "{{pollCommand}}"
steps:
