From 0b97f134f2deafd8855ec13c4dead259fe988a2f Mon Sep 17 00:00:00 2001 From: Erik Nordmark Date: Fri, 3 Apr 2026 09:34:41 -0700 Subject: [PATCH] [PLACEHOLDER] sftp: Use of insecure HostKeyCallback implementation Use this PR as a reminder that we should look into making the server side of sftp more secure. Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: eriknordmark --- zedUpload/sftputil/sftp.go | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/zedUpload/sftputil/sftp.go b/zedUpload/sftputil/sftp.go index e8e8d36..4aa0b1a 100644 --- a/zedUpload/sftputil/sftp.go +++ b/zedUpload/sftputil/sftp.go @@ -29,6 +29,16 @@ type Resp struct { } func getSftpClient(host, user, pass string) (*sftp.Client, error) { + // Load allowed host public key from a file and use it to verify the server's host key. + hostKeyBytes, err := os.ReadFile("/etc/ssh/sftp_hostkey.pub") + if err != nil { + return nil, fmt.Errorf("failed to read allowed host key: %w", err) + } + allowedHostKey, _, _, _, err := ssh.ParseAuthorizedKey(hostKeyBytes) + if err != nil { + return nil, fmt.Errorf("failed to parse allowed host key: %w", err) + } + clientConfig := &ssh.ClientConfig{ User: user, Auth: []ssh.AuthMethod{ @@ -36,13 +46,13 @@ func getSftpClient(host, user, pass string) (*sftp.Client, error) { ssh.KeyboardInteractive( func(user, instruction string, questions []string, echos []bool) ([]string, error) { answers := make([]string, len(questions)) - for i := range answers { + for i := range answers { answers[i] = pass } return answers, nil }), }, - HostKeyCallback: ssh.InsecureIgnoreHostKey(), + HostKeyCallback: ssh.FixedHostKey(allowedHostKey), Timeout: time.Duration(10) * time.Second, }