davsclaus commented on code in PR #27821:
URL: https://github.com/apache/camel/pull/27821#discussion_r4275134934
##########
components/camel-ssh/src/main/docs/ssh-component.adoc:
##########
@@ -163,6 +163,72 @@ YAML::
An example of using Public Key authentication is provided in
`examples/camel-example-ssh-security`.
+=== Server host key verification
+
+The SSH Component verifies the host key of the SSH server only when the
`knownHostsResource` option
+is set. It refers to a file in the OpenSSH `known_hosts` format, such as the
output of `ssh-keyscan`.
+Set `failOnUnknownHost` to `true` as well, so that a server without any entry
in that file is rejected.
+When it is `false` (the default), such a server is accepted and a warning is
logged.
+
+The entries are matched as OpenSSH matches them:
+
+* Each host pattern of an entry is compared, ignoring case, with the host name
or address configured
+on the endpoint, written `host` for port 22 and `[host]:port` for another
port. `*` and `?` are
+wildcards, a pattern starting with `!` excludes the hosts it matches, and
hashed entries are supported.
+So `db.example.com` only applies to port 22, `[db.example.com]:2222` to port
2222, and `*` to every
+host and port. The configured value is used as it is written: an endpoint
configured with an address
+only uses the entries for that address, and an IPv6 address such as `::1` (or
`[::1]` in the endpoint
+uri) is not expanded.
Review Comment:
`SshComponentKnownHostIPv6Test` says the endpoint uri does not accept an
IPv6 address, and sets the host with `endpoint.setHost("::1")`. Camel's
`UnsafeUriCharactersEncoder` also encodes `[` and `]`, so
`SshConfiguration.configure` would get no host from `ssh://user@[::1]:2222`.
Unless that form was tested, I would drop the uri part:
```suggestion
only uses the entries for that address, and an IPv6 address such as `::1` is
not expanded.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
