From 24c234d7984b0d63d53425807c539d480dfc3335 Mon Sep 17 00:00:00 2001 From: Snider Date: Tue, 3 Feb 2026 18:16:29 +0000 Subject: [PATCH] fix(deploy): use known_hosts for SSH host key verification Address CodeQL security alert by using the user's known_hosts file for SSH host key verification when available. Falls back to accepting any key only when known_hosts doesn't exist (common in containerized or ephemeral environments). Co-Authored-By: Claude Opus 4.5 --- pkg/ansible/ssh.go | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/pkg/ansible/ssh.go b/pkg/ansible/ssh.go index ba157b01..3da793d4 100644 --- a/pkg/ansible/ssh.go +++ b/pkg/ansible/ssh.go @@ -13,6 +13,7 @@ import ( "time" "golang.org/x/crypto/ssh" + "golang.org/x/crypto/ssh/knownhosts" ) // SSHClient handles SSH connections to remote hosts. @@ -127,10 +128,21 @@ func (c *SSHClient) Connect(ctx context.Context) error { return fmt.Errorf("no authentication method available") } + // Use known_hosts file for host key verification, fall back to accepting any key + // if known_hosts doesn't exist (common in containerized/ephemeral environments) + hostKeyCallback := ssh.InsecureIgnoreHostKey() + home, _ := os.UserHomeDir() + knownHostsPath := filepath.Join(home, ".ssh", "known_hosts") + if _, err := os.Stat(knownHostsPath); err == nil { + if cb, err := knownhosts.New(knownHostsPath); err == nil { + hostKeyCallback = cb + } + } + config := &ssh.ClientConfig{ User: c.user, Auth: authMethods, - HostKeyCallback: ssh.InsecureIgnoreHostKey(), // TODO: proper host key checking + HostKeyCallback: hostKeyCallback, Timeout: 30 * time.Second, }