fix: harden SSH trust and dependency security

2026-06-02 12:25:20 +01:00
parent fb230ee35d
commit ea6a9743d1
17 changed files with 1365 additions and 186 deletions
@@ -596,12 +596,7 @@ func (c *Client) connectViaJumpHosts(sc models.SSHConfig, finalConfig *ssh.Clien
 			jumpAuth = append(jumpAuth, ssh.PublicKeys(signer))
 		}

-		jumpConfig := &ssh.ClientConfig{
-			User:            jump.Username,
-			Auth:            jumpAuth,
-			HostKeyCallback: ssh.InsecureIgnoreHostKey(),
-			Timeout:         finalConfig.Timeout,
-		}
+		jumpConfig := jumpHostClientConfig(jump, jumpAuth, finalConfig)

 		if currentClient == nil {
 			client, err := ssh.Dial("tcp", jumpAddr, jumpConfig)
@@ -648,6 +643,15 @@ func (c *Client) connectViaJumpHosts(sc models.SSHConfig, finalConfig *ssh.Clien
 	return ssh.NewClient(ncc, chans, reqs), nil
 }

+func jumpHostClientConfig(jump models.JumpHost, auth []ssh.AuthMethod, finalConfig *ssh.ClientConfig) *ssh.ClientConfig {
+	return &ssh.ClientConfig{
+		User:            jump.Username,
+		Auth:            auth,
+		HostKeyCallback: finalConfig.HostKeyCallback,
+		Timeout:         finalConfig.Timeout,
+	}
+}
+
 // parsePrivateKey loads and parses an SSH private key file. If the key is
 // encrypted and getPassphrase is provided, it will attempt decryption.
 func (c *Client) parsePrivateKey(path string, getPassphrase func() (string, error)) (ssh.Signer, error) {