Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable StrictHostKeyChecking for SSH connection to nodes #29

Open
abbashus opened this issue Oct 27, 2021 · 0 comments
Open

Enable StrictHostKeyChecking for SSH connection to nodes #29

abbashus opened this issue Oct 27, 2021 · 0 comments

Comments

@abbashus
Copy link
Contributor

On connecting to an address for which an SSH client has no known host key, it will prompt the user whether it wants to allow-list that key; subsequent connections to that address will fail if the server fails to present the same identity.

By setting StrictHostKeyChecking to no, the target code disables host key checking in the client. As a result, it will never check the identity of the server either on its first or subsequent connections. An attacker on the network will therefore be able to spoof a bastion or remote host (depending on network position) at any time (as opposed to just during the first connection) and a victim will have no way to detect this attack.

abbashus added a commit to abbashus/project-website-search that referenced this issue Nov 8, 2021
Signed-off-by: Abbas Hussain <abbas_10690@yahoo.com>
@abbashus abbashus mentioned this issue Nov 8, 2021
1 task
abbashus added a commit that referenced this issue Nov 10, 2021
Fixes issue #29, #32 and enabled logging and control via CLI arguments

Signed-off-by: Abbas Hussain <abbas_10690@yahoo.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant