[
https://issues.apache.org/jira/browse/VFS-867?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino deleted VFS-867:
---------------------------------
> Harden default SFTP host-key checking (StrictHostKeyChecking defaults to "no")
> ------------------------------------------------------------------------------
>
> Key: VFS-867
> URL: https://issues.apache.org/jira/browse/VFS-867
> Project: Commons VFS
> Issue Type: Improvement
> Reporter: Andrea Cosentino
> Priority: Major
>
> {{SftpFileSystemConfigBuilder.getStrictHostKeyChecking()}} returns {{"no"}}
> when the caller has not set the option (the {{HOST_KEY_CHECK_NO}} default in
> {{commons-vfs2/src/main/java/org/apache/commons/vfs2/provider/sftp/SftpFileSystemConfigBuilder.java}}).
> As a result, the SFTP provider does *not verify the server's SSH host key by
> default*. A caller who does not explicitly set {{StrictHostKeyChecking}} to
> {{"ask"}}/{{"yes"}} and supply a known-hosts source is exposed to a
> man-in-the-middle attack on an untrusted network.
> h3. Why this matters
> Host-key verification is SSH's defense against MITM. Defaulting it off makes
> the _secure_ configuration opt-in, which is easy to miss. This is the
> "insecure default" pattern recorded in the VFS threat model (section 5a /
> section 9, "SFTP MITM under the default configuration").
> h3. Proposal (for discussion)
> # Change the default to {{"ask"}} (JSch's own default) or {{"yes"}}, so
> verification is on unless explicitly disabled. This is a behavior change:
> callers relying on the silent-accept default would need to supply a
> known-hosts source or explicitly set {{"no"}}.
> # If a hard default change is too disruptive for a minor release: emit a
> one-time warning when SFTP connects with {{StrictHostKeyChecking=no}} and no
> known-hosts configured, document the risk prominently, and change the default
> in the next major release.
> h3. Compatibility
> Changing the default is source-compatible but behavior-changing; it belongs
> in a release where such a change is acceptable, and should be called out in
> RELEASE-NOTES / migration notes. Callers can restore the old behavior with
> {{SftpFileSystemConfigBuilder.setStrictHostKeyChecking(opts, "no")}}.
> h3. References
> * {{provider/sftp/SftpFileSystemConfigBuilder.java}} —
> {{getStrictHostKeyChecking}} default
> * VFS threat model section 5a (configuration variants) and section 9
> (properties not provided)
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
