Join GitHub today
only rsa host key checked #865
I'm testing with Fabric==1.13.1, paramiko==2.1.1, cryptography==1.7.1
The default ssh server setup on ubuntu 16.04 (and probably most recent versions of ubuntu and debian) is to generate one of each kind of host key. The default
When using the openssh client (6.9p1 on MacOS 10.11), it chooses the ecdsa key to put in
But paramiko seems to only look at the rsa one, sees that it's not the same type as what's in known_hosts, and so ignores it. Thus paramiko never notices when the host key changes.
But if I put an incorrect rsa key in known_hosts, paramiko correctly notices that the host key is wrong. Or, if I put an incorrect ecdsa key in known_hosts, and change
This also works to hide the problem pointed out in #794 - if the ecdsa-sha2-nistp384/521 key is not the only host key, if there is also a dsa or rsa host key in sshd_config, then paramiko will use the rsa or dsa host key and will seem to work. (But if you had the ecdsa key in known_hosts, it's not being checked.)
(As a final detail, recent openssh server and client will refuse to actually use the dsa key, I think it's obsolete.)
I admittedly only searched "ecdsa", and also didn't fully understand the situation until halfway through writing the report (I initially thought ecdsa keys were never checked).
By the way, it looks like you may have forgotten about #794, which it looks like you intended to apply the change from (in a linked gist, only two lines). That's very understandable, as there are many open issues and pull requests that have a accumulated over a long time. I would humbly suggest leaning more towards closing issues, and especially pull requests, when in doubt. Even this one, if you think #387 and some other issue covers it ;)
Rule of thumb is if it's got a milestone assigned, I haven't forgotten, even if I have had to punt it a few times :) and #794 is in the "next feature release" milestone. The previous release cycle was me trying to make up for lost time so I only got through about half of what was assigned; the rest I'll be trying to knock out in the next month or so (holiday travel notwithstanding).
Overall, I am way overdue for a mass culling of tickets, for sure...something I want to do before I put out a much ballyhooed 2.0 of another project :)