oscerd commented on code in PR #27821:
URL: https://github.com/apache/camel/pull/27821#discussion_r4280653521
##########
components/camel-ssh/src/main/docs/ssh-component.adoc:
##########
@@ -163,6 +163,72 @@ YAML::
An example of using Public Key authentication is provided in
`examples/camel-example-ssh-security`.
+=== Server host key verification
+
+The SSH Component verifies the host key of the SSH server only when the
`knownHostsResource` option
+is set. It refers to a file in the OpenSSH `known_hosts` format, such as the
output of `ssh-keyscan`.
+Set `failOnUnknownHost` to `true` as well, so that a server without any entry
in that file is rejected.
+When it is `false` (the default), such a server is accepted and a warning is
logged.
+
+The entries are matched as OpenSSH matches them:
+
+* Each host pattern of an entry is compared, ignoring case, with the host name
or address configured
+on the endpoint, written `host` for port 22 and `[host]:port` for another
port. `*` and `?` are
+wildcards, a pattern starting with `!` excludes the hosts it matches, and
hashed entries are supported.
+So `db.example.com` only applies to port 22, `[db.example.com]:2222` to port
2222, and `*` to every
+host and port. The configured value is used as it is written: an endpoint
configured with an address
+only uses the entries for that address, and an IPv6 address such as `::1` (or
`[::1]` in the endpoint
+uri) is not expanded.
Review Comment:
Applied in 1d26dcebcfa6. The question from your review is fixed too, rather
than only documented:
- **Docs:** the uri part is dropped. The sentence now ends "an endpoint
configured with an address only uses the entries for that address, and an IPv6
address such as `::1` is not expanded." The bracket stripping stays for
`setHost("[::1]")`.
- **`~/.ssh/config`:** the verifier now looks up the host name or address
the client connects to, as OpenSSH does. That is the `HostName` SSHD resolved,
never resolved through DNS. Only an IPv6 address configured on the endpoint
keeps its written spelling, because the connected address writes it in its full
form.
- `looksUpTheHostNameTheClientConnectsTo` (endpoint `db`, connected as
`db.example.com`) fails on a1d570a52eef.
- The docs, the class and constructor javadoc and the three upgrade notes
describe the rule.
- **Fix versions:** noted. 4.22.2 and 4.18.6 go on CAMEL-25644 when the
backports are merged.
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
