oscerd commented on code in PR #27821: URL: https://github.com/apache/camel/pull/27821#discussion_r4269941528
########## components/camel-ssh/src/main/docs/ssh-component.adoc: ########## @@ -163,6 +163,67 @@ YAML:: An example of using Public Key authentication is provided in `examples/camel-example-ssh-security`. +=== Server host key verification + +The SSH Component verifies the host key of the SSH server only when the `knownHostsResource` option +is set. It refers to a file in the OpenSSH `known_hosts` format, such as the output of `ssh-keyscan`. +Set `failOnUnknownHost` to `true` as well, so that a server without any entry in that file is rejected. +When it is `false` (the default), such a server is accepted and a warning is logged. + +The entries are matched as OpenSSH matches them: + +* The host name or address configured on the endpoint is compared with each comma-separated host +pattern of an entry, ignoring case. Wildcards (`*` and `?`), negated patterns (`!`) and hashed +entries are supported. The configured value is used as is: an endpoint configured with an address +only uses the entries for that address. +* An entry without a port applies to port 22 only. For another port, use the `[host]:port` form, Review Comment: Covered by the rewrite in 370054641e57: the verifier no longer uses SSHD's pattern matching. Each pattern, and each hashed entry, is matched against the name OpenSSH looks the server up by: `host` for port 22, `[host]:port` for another port. `*` and `?` are wildcards, and `!` applies per pattern. As in OpenSSH: - `*` and `*db*` apply to port 2222; - `* ssh-ed25519 ...` lists a host on port 2222; - `db.example.com` only applies to port 22. The test is `matchesPatternsAgainstTheHostAndPortAsOpenSshWritesThem`, and the docs and upgrade notes now describe this rule. _Claude Code on behalf of Andrea Cosentino (@oscerd)_ ########## components/camel-ssh/src/main/docs/ssh-component.adoc: ########## @@ -163,6 +163,67 @@ YAML:: An example of using Public Key authentication is provided in `examples/camel-example-ssh-security`. +=== Server host key verification + +The SSH Component verifies the host key of the SSH server only when the `knownHostsResource` option +is set. It refers to a file in the OpenSSH `known_hosts` format, such as the output of `ssh-keyscan`. +Set `failOnUnknownHost` to `true` as well, so that a server without any entry in that file is rejected. +When it is `false` (the default), such a server is accepted and a warning is logged. + +The entries are matched as OpenSSH matches them: + +* The host name or address configured on the endpoint is compared with each comma-separated host +pattern of an entry, ignoring case. Wildcards (`*` and `?`), negated patterns (`!`) and hashed +entries are supported. The configured value is used as is: an endpoint configured with an address +only uses the entries for that address. +* An entry without a port applies to port 22 only. For another port, use the `[host]:port` form, +for example `[db.example.com]:2222`. +* The server is accepted when one of the entries for its host lists the key it presents. A host can be +listed with several keys, one per line. +* The server is rejected when the key it presents is listed in a matching `@revoked` entry, or when +its host has entries but none of them lists that key, whatever the value of `failOnUnknownHost`. Review Comment: Applied in 370054641e57: "when its host has entries without a marker but none of them lists that key" is now used in the docs, the `failOnUnknownHost` description and javadoc, the class javadoc and the three upgrade-guide notes. _Claude Code on behalf of Andrea Cosentino (@oscerd)_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
