davsclaus commented on code in PR #27821: URL: https://github.com/apache/camel/pull/27821#discussion_r4269534571
########## components/camel-ssh/src/main/docs/ssh-component.adoc: ########## @@ -163,6 +163,67 @@ YAML:: An example of using Public Key authentication is provided in `examples/camel-example-ssh-security`. +=== Server host key verification + +The SSH Component verifies the host key of the SSH server only when the `knownHostsResource` option +is set. It refers to a file in the OpenSSH `known_hosts` format, such as the output of `ssh-keyscan`. +Set `failOnUnknownHost` to `true` as well, so that a server without any entry in that file is rejected. +When it is `false` (the default), such a server is accepted and a warning is logged. + +The entries are matched as OpenSSH matches them: + +* The host name or address configured on the endpoint is compared with each comma-separated host +pattern of an entry, ignoring case. Wildcards (`*` and `?`), negated patterns (`!`) and hashed +entries are supported. The configured value is used as is: an endpoint configured with an address +only uses the entries for that address. +* An entry without a port applies to port 22 only. For another port, use the `[host]:port` form, Review Comment: This rule comes from SSHD, not from OpenSSH. In OpenSSH, a pattern without a port is matched against `[host]:port` for a non-default port, so `*` (or `*db*`) also applies to port 2222. In SSHD it only ever applies to port 22. That is the cause of the `@revoked *` gap, and it also means that `* ssh-ed25519 ...` makes a host on port 2222 unknown in Camel, while OpenSSH uses the entry. One way to match OpenSSH: when the port is not 22, also check the entry against `"[" + host + "]:" + port` at port 22. A hashed entry for `(host, port)` hashes the same string, so that case still works. Keep the negation handling per entry. If you keep the SSHD rule, please say in line 173 and in the upgrade guide that wildcard patterns differ from OpenSSH here, because "matched as OpenSSH matches them" is not quite true then. ########## components/camel-ssh/src/main/docs/ssh-component.adoc: ########## @@ -163,6 +163,67 @@ YAML:: An example of using Public Key authentication is provided in `examples/camel-example-ssh-security`. +=== Server host key verification + +The SSH Component verifies the host key of the SSH server only when the `knownHostsResource` option +is set. It refers to a file in the OpenSSH `known_hosts` format, such as the output of `ssh-keyscan`. +Set `failOnUnknownHost` to `true` as well, so that a server without any entry in that file is rejected. +When it is `false` (the default), such a server is accepted and a warning is logged. + +The entries are matched as OpenSSH matches them: + +* The host name or address configured on the endpoint is compared with each comma-separated host +pattern of an entry, ignoring case. Wildcards (`*` and `?`), negated patterns (`!`) and hashed +entries are supported. The configured value is used as is: an endpoint configured with an address +only uses the entries for that address. +* An entry without a port applies to port 22 only. For another port, use the `[host]:port` form, +for example `[db.example.com]:2222`. +* The server is accepted when one of the entries for its host lists the key it presents. A host can be +listed with several keys, one per line. +* The server is rejected when the key it presents is listed in a matching `@revoked` entry, or when +its host has entries but none of them lists that key, whatever the value of `failOnUnknownHost`. Review Comment: "its host has entries" reads as if a `@revoked` line counts too. The code (like OpenSSH and SSHD's `KnownHostsServerKeyVerifier`) only counts entries without a marker, so a host listed only in `@revoked` lines is an unknown host. Suggest: "or when its host has entries without a marker but none of them lists that key". The same applies to the `failOnUnknownHost` description in `SshConfiguration` and to the upgrade-guide entries. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
