Andrea Cosentino created VFS-867:
------------------------------------
Summary: Harden default SFTP host-key checking
(StrictHostKeyChecking defaults to "no")
Key: VFS-867
URL: https://issues.apache.org/jira/browse/VFS-867
Project: Commons VFS
Issue Type: Improvement
Reporter: Andrea Cosentino
{{SftpFileSystemConfigBuilder.getStrictHostKeyChecking()}} returns {{"no"}}
when the caller has not set the option (the {{HOST_KEY_CHECK_NO}} default in
{{commons-vfs2/src/main/java/org/apache/commons/vfs2/provider/sftp/SftpFileSystemConfigBuilder.java}}).
As a result, the SFTP provider does *not verify the server's SSH host key by
default*. A caller who does not explicitly set {{StrictHostKeyChecking}} to
{{"ask"}}/{{"yes"}} and supply a known-hosts source is exposed to a
man-in-the-middle attack on an untrusted network.
h3. Why this matters
Host-key verification is SSH's defense against MITM. Defaulting it off makes
the _secure_ configuration opt-in, which is easy to miss. This is the "insecure
default" pattern recorded in the VFS threat model (section 5a / section 9,
"SFTP MITM under the default configuration").
h3. Proposal (for discussion)
# Change the default to {{"ask"}} (JSch's own default) or {{"yes"}}, so
verification is on unless explicitly disabled. This is a behavior change:
callers relying on the silent-accept default would need to supply a known-hosts
source or explicitly set {{"no"}}.
# If a hard default change is too disruptive for a minor release: emit a
one-time warning when SFTP connects with {{StrictHostKeyChecking=no}} and no
known-hosts configured, document the risk prominently, and change the default
in the next major release.
h3. Compatibility
Changing the default is source-compatible but behavior-changing; it belongs in
a release where such a change is acceptable, and should be called out in
RELEASE-NOTES / migration notes. Callers can restore the old behavior with
{{SftpFileSystemConfigBuilder.setStrictHostKeyChecking(opts, "no")}}.
h3. References
* {{provider/sftp/SftpFileSystemConfigBuilder.java}} —
{{getStrictHostKeyChecking}} default
* VFS threat model section 5a (configuration variants) and section 9
(properties not provided)
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
