hierynomus / hierynomus/sshj

Order proposed host key algorithms by known hosts

Open
#642 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
2.7k
Forks
620
Avg merge
3d 23h
Merged PRs (30d)
11

Description

Consider this scenario. We are connecting to a server with an RSA host key, and we store this key in our known hosts thing. The server then adds another key, say, Ed25519. Since sshj prefers Ed25519 over RSA, it will choose to verify using `ssh-ed25519`, which will obviously fail and will probably lead to a huge warning to boot.

OpenSSH [reorders](https://github.com/openssh/openssh-portable/blob/master@%7B2020-10-06T10:04:42Z%7D/sshconnect2.c#L122-L209) host keys algorithms by host key entries, putting the ones that can be actually used for verification at the front. It would be nice if sshj did the same.

While you can specify algorithms via configuration, it means that one have to create a new configuration for each server. Also, I don't think you can easily get available key types from `OpenSSHKnownHosts`.

I would expect something along `ssh.setAvailableHostKeyTypes(hostKeys.getAvailableHostKeyTypes(host, port))`

(Note that for this purpose it might be wise to consider ECDSA keys with different curves as different key types, which sshj seems to be doing anyway)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.