search

darkoperator / Posh-SSH

PowerShell Module for automating tasks on remote systems using SSH
BSD 3-Clause "New" or "Revised" License
985 stars 227 forks source link

No port discrimination in key checks #516

Open MatthiasHHI opened 1 year ago

MatthiasHHI commented 1 year ago

If you connect to a remote server, it is not discriminated between different ports. Please see my .ssh\known_hosts from the OpenSSH client (a bit anonymized):

[hlgXXXX]:22011,[172.16.xx.xx]:22011 ecdsa-sha2-nistp256 AAAAE2VjZHNhLX[...]\ [hlgXXXX]:22012,[172.16.xx.xx]:22012 ssh-rsa AAAAB3NzaC1yc2EAAAADAQ[...]

and the .poshssh\hosts.json for comparison (also anonymized):

{\ "Keys": {\ "HLGXXXX": {\ "HostKeyName": "ssh-ed25519",\ "Fingerprint": "7f:ce:4b:...:f6"\ },\ "hlgXXXX": {\ "HostKeyName": "ssh-rsa",\ "Fingerprint": "66:e1:93:...:0"\ }\ }\ }

<No port entry can be found here when addressing 2 different servers by same host name (or IP) but different ports.

Additionally: Once the host name is written with capital and once with small letters (for Windows host names all the same), so host name with capital letters to port 22011 runs through, host name with small letters and port 22011 throws a SecurityError.

Agent-E11 commented 1 day ago

This has been an issue for me as well. The utility ssh-keyscan, if passed a port, generates a line in the format [host]:port key-type key.

It looks like this host is not even recognized, and if I were to run New-SFTPSession - ComputerName host -ErrorOnUntrusted, the cmdlet would fail.

darkoperator commented 1 day ago

Limitation acknowledged. I only check hostname as typed and key, not port. Next time I dedicate some hours to work on the module I will see what I can do.