Update README.md - Jenkinsfile Example - With keyscan to prevent "Host key verification failed" errors#57
Conversation
Jenkinsfile Example - With keyscan to prevent "Host key verification failed" errors
README.md
Outdated
| steps { | ||
| sshagent (credentials: ['ssh-credentials-id']) { | ||
| sh '[ -d ~/.ssh ] || mkdir ~/.ssh && chmod 0700 ~/.ssh' | ||
| sh 'echo "$(ssh-keyscan -t rsa,dsa example.com)" >> ~/.ssh/known_hosts' |
There was a problem hiding this comment.
Is this something that ought to be a direct feature of the plugin?
There was a problem hiding this comment.
There was a problem hiding this comment.
Hi @jglick, yes indeed - instead of setting StrictHostKeyChecking=no the plugin should get an feature to manage/automatically import hosts keys to known_hosts file/store.
There was a problem hiding this comment.
I see. Please file this in Jira, though I do not plan to spend time on such a feature.
There was a problem hiding this comment.
sh 'echo "$(ssh-keyscan -t rsa,dsa example.com)" >> ~/.ssh/known_hosts'
This is actually circumventing the actual host verification: if there is a man-the-middle, ssh-keyscan -t rsa,dsa example.com will actually return that machine's fingerprint instead of the one from example.com.
If we already have the appropriate entry in known_hosts, this is mitigated by the fact that ssh will complain about multiple entries, but still it is a bit of a bad workaround.
What is actually needed, is to provide a static reference of the official fingerprints (config file or something similar, ideally)
There was a problem hiding this comment.
You could hard-code such fingerprints, or use the config-file-provider plugin, etc.
Feel free to file an amending PR explaining what you think is a safer practice.
Co-authored-by: Jesse Glick <jglick@cloudbees.com>
Co-authored-by: Jesse Glick <jglick@cloudbees.com>
README.md
Outdated
| steps { | ||
| sshagent (credentials: ['ssh-credentials-id']) { | ||
| sh '[ -d ~/.ssh ] || mkdir ~/.ssh && chmod 0700 ~/.ssh' | ||
| sh 'echo "$(ssh-keyscan -t rsa,dsa example.com)" >> ~/.ssh/known_hosts' |
There was a problem hiding this comment.
I see. Please file this in Jira, though I do not plan to spend time on such a feature.
Added Jenkinsfile example to README - With keyscan to prevent "Host key verification failed" errors