[Bug 42517] New: Allow option to set StrictHostKeyChecking=accept-new for SFTP
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42517 Bug ID: 42517 Summary: Allow option to set StrictHostKeyChecking=accept-new for SFTP Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: lisette@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org SFTP keys have to be accepted on the command line level currently, it would be helpful if in the kohaconf we could set StrictHostKeyChecking=accept-new to streamline sftp setups, but still have it be controlled from the server side. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42517 Tristin Stagg <tristin.stagg@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tristin.stagg@bywatersoluti | |ons.com --- Comment #1 from Tristin Stagg <tristin.stagg@bywatersolutions.com> --- Yes! When Koha acts as an SFTP client, often times server administrators will need to go on the server and accept host keys before the integration works. I think we are OK with Koha integrations automatically accepting this on our behalf. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42517 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42517 --- Comment #2 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Should we instead have some step in which the handshake is done, and the new key printed in a modal or smth, and the staff accept/confirm it? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42517 --- Comment #3 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 198535 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=198535&action=edit Bug 42517: Update database Patch from commit 75a0dac -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42517 --- Comment #4 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 198536 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=198536&action=edit Bug 42517: Allow option to set StrictHostKeyChecking=accept-new for SFTP This version of the patch sets the option at the file transport level for maximum flexibility and self-service ability. 1) Run updatedatabase.pl 2) Restart all the things! 3) Install and start an SSH server, give the kohadev-koha user a password, allow password auth, and clear any cached host key: apt-get update && apt-get install -y openssh-server mkdir -p /run/sshd && /usr/sbin/sshd echo "kohadev-koha:koha" | chpasswd sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config pkill -HUP sshd su - kohadev-koha -c 'rm -f ~/.ssh/known_hosts' 4) In the staff client create a new file transport with Transport: SFTP Host: localhost Port: 22 Strict host key checking: No (always accept the host key automatically) Authentication mode: Password-based Username: kohadev-koha Password: koha 5) Wipe known_hosts again, chnage strict host key checking to yes 6) rm -f ~/.ssh/known_hosts 7) Connection test fails with "Host key verification failed"! 8) Set transport to accept-new 9) Connection test passes! 10) Edit the transport again, switch back to "Yes" 11) Connection test still passes -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42517 --- Comment #5 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 198537 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=198537&action=edit Bug 42517: Add unit tests Patch from commit 7bcb861 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42517 --- Comment #6 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 198538 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=198538&action=edit Bug 42517: Update schema file [DO NOT PUSH] Patch from commit 13a257d -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42517 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42517 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42517 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@openfifth.c |y.org |o.uk CC| |martin.renvoize@openfifth.c | |o.uk -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon@bugs.koha-community.org