[SECURITY-161] Add Admin warning for hosts missing SSH key verification

src/main/java/hudson/plugins/sshslaves/verifiers/MissingVerifierAdministrativeMonitor.java

@@ -0,0 +1,58 @@
+/*
+ * The MIT License
+ *
+ * Copyright (c) 2016, Michael Clarke
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+package hudson.plugins.sshslaves.verifiers;
+
+import hudson.Extension;
+import hudson.model.AdministrativeMonitor;
+import hudson.model.Computer;
+import hudson.plugins.sshslaves.SSHLauncher;
+import hudson.slaves.ComputerLauncher;
+import hudson.slaves.SlaveComputer;
+import jenkins.model.Jenkins;
+
+/**
+ * An administrative warning that checks all SSH slaves have a {@link HostKeyVerifier}
+ * set against them and prompts the admin to update the settings as needed.
+ * @author Michael Clarke
+ * @since 1.12
+ */
+@Extension
+public class MissingVerifierAdministrativeMonitor extends AdministrativeMonitor {
+
+    @Override
+    public boolean isActivated() {
+        for (Computer computer : Jenkins.getInstance().getComputers()) {
+            if (computer instanceof SlaveComputer) {
+                ComputerLauncher launcher = ((SlaveComputer) computer).getLauncher();
+
+                if (launcher instanceof SSHLauncher && null == ((SSHLauncher) launcher).getHostKeyVerifier()) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+}

src/main/resources/hudson/plugins/sshslaves/verifiers/MissingVerifierAdministrativeMonitor/message.jelly

@@ -0,0 +1,29 @@
+<!--
+The MIT License
+
+Copyright (c) 2016, Michael Clarke
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+-->
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:c="/lib/credentials">
+    <div class="warning">
+        <p>SSH Host Key Verifiers are not configured for all SSH slaves on this Jenkins instance. This could leave these slaves open to man-in-the-middle attacks. <a href="${rootURL}/computer/">Update your slave configuration</a> to resolve this.</p>
+    </div>
+</j:jelly>