Order proposed host key algorithms by known hosts
- Dominant language
- Java
- Stars
- 2.7k
- Forks
- 620
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 11
Description
Consider this scenario. We are connecting to a server with an RSA host key, and we store this key in our known hosts thing. The server then adds another key, say, Ed25519. Since sshj prefers Ed25519 over RSA, it will choose to verify using `ssh-ed25519`, which will obviously fail and will probably lead to a huge warning to boot.
OpenSSH [reorders](https://github.com/openssh/openssh-portable/blob/master@%7B2020-10-06T10:04:42Z%7D/sshconnect2.c#L122-L209) host keys algorithms by host key entries, putting the ones that can be actually used for verification at the front. It would be nice if sshj did the same.
While you can specify algorithms via configuration, it means that one have to create a new configuration for each server. Also, I don't think you can easily get available key types from `OpenSSHKnownHosts`.
I would expect something along `ssh.setAvailableHostKeyTypes(hostKeys.getAvailableHostKeyTypes(host, port))`
(Note that for this purpose it might be wise to consider ECDSA keys with different curves as different key types, which sshj seems to be doing anyway)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.