org.eclipse.jgit.internal.transport.sshd

Class OpenSshServerKeyVerifier

java.lang.Object

org.eclipse.jgit.internal.transport.sshd.OpenSshServerKeyVerifier

All Implemented Interfaces:

org.apache.sshd.client.keyverifier.ServerKeyVerifier, ServerKeyLookup

public class OpenSshServerKeyVerifier
extends Object
implements org.apache.sshd.client.keyverifier.ServerKeyVerifier, ServerKeyLookup

A sever host key verifier that honors the StrictHostKeyChecking and UserKnownHostsFile values from the ssh configuration.

The verifier can be given default known_hosts files in the constructor, which will be used if the ssh config does not specify a UserKnownHostsFile. If the ssh config does set UserKnownHostsFile, the verifier uses the given files in the order given. Non-existing or unreadable files are ignored.

StrictHostKeyChecking accepts the following values:

ask

Ask the user whether new or changed keys shall be accepted and be added to the known_hosts file.

yes/true

Accept only keys listed in the known_hosts file.

no/false

Silently accept all new or changed keys, add new keys to the known_hosts file.

accept-new

Silently accept keys for new hosts and add them to the known_hosts file.

If StrictHostKeyChecking is not set, or set to any other value, the default value ask is active.

This implementation relies on the ClientSession being a JGitClientSession. By default Apache MINA sshd does not forward the config file host entry to the session, so it would be unknown here which entry it was and what setting of StrictHostKeyChecking should be used. If used with some other session type, the implementation assumes "ask".

Asking the user is done via a CredentialsProvider obtained from the session. If none is set, the implementation falls back to strict host key checking ("yes").

Note that adding a key to the known hosts file may create the file. You can specify in the constructor whether the user shall be asked about that, too. If the user declines updating the file, but the key was otherwise accepted (user confirmed for "ask", or "no" or "accept-new" are active), the key is accepted for this session only.

If several known hosts files are specified, a new key is always added to the first file (even if it doesn't exist yet; see the note about file creation above).

See Also:

man ssh-config

Constructor Summary

Constructors

Constructor and Description
OpenSshServerKeyVerifier(boolean askAboutNewFile, List<Path> defaultFiles) Creates a new OpenSshServerKeyVerifier.

Method Summary

Modifier and Type	Method and Description
List<org.apache.sshd.client.keyverifier.KnownHostsServerKeyVerifier.HostEntryPair>	lookup(org.apache.sshd.client.session.ClientSession session, SocketAddress remote) Retrieves all entries for a given remote address.
boolean	verifyServerKey(org.apache.sshd.client.session.ClientSession clientSession, SocketAddress remoteAddress, PublicKey serverKey)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

OpenSshServerKeyVerifier

public OpenSshServerKeyVerifier(boolean askAboutNewFile,
                                List<Path> defaultFiles)

Creates a new OpenSshServerKeyVerifier.

Parameters:

askAboutNewFile - whether to ask the user, if possible, about creating a new non-existing known_hosts file

defaultFiles - typically ~/.ssh/known_hosts and ~/.ssh/known_hosts2. May be empty or null, in which case no default files are installed. The files need not exist.

Method Detail

lookup

public List<org.apache.sshd.client.keyverifier.KnownHostsServerKeyVerifier.HostEntryPair> lookup(org.apache.sshd.client.session.ClientSession session,
                                                                                                 SocketAddress remote)

Description copied from interface: ServerKeyLookup

Retrieves all entries for a given remote address.

Specified by:

lookup in interface ServerKeyLookup

Parameters:

session - needed to determine the config files if specified in the ssh config

remote - to find entries for

Returns:

a possibly empty list of entries found, including revoked ones

verifyServerKey

public boolean verifyServerKey(org.apache.sshd.client.session.ClientSession clientSession,
                               SocketAddress remoteAddress,
                               PublicKey serverKey)

Specified by:

verifyServerKey in interface org.apache.sshd.client.keyverifier.ServerKeyVerifier