search

delfick / bespin

Opinionated wrapper around boto that reads yaml
MIT License
6 stars 8 forks source link

Unpin paramiko #82

Closed atward closed 7 years ago

atward commented 7 years ago

paramiko 1.x relies on insecure dependencies

Was previously pinned in 7566e1fe - unsure why.

atward commented 7 years ago

paramiko 2.x api matches 1.x for all uses in bespin.operations.ssh.

atward commented 7 years ago

radssh 1.1.1 deprecates 'hostkey.verify' in favour of setting it via standard ssh_config(5) file https://github.com/radssh/radssh/blob/512e532f35e04fccc13fa2df7fd52e06e31df451/radssh/config.py#L29 https://github.com/delfick/bespin/blob/9789ec2dbf07b8af00ea4875f7e359b801a7a4c0/bespin/operations/ssh.py#L48

include_agent also will no longer be valid starting from radssh 2.0 https://github.com/delfick/bespin/blob/9789ec2dbf07b8af00ea4875f7e359b801a7a4c0/bespin/operations/ssh.py#L64 FutureWarning: AuthManager will no longer support include_agent starting with 2.0: passed value (True) ignored

delfick commented 7 years ago

I probably had reasons why I pinned it, but I'm also unsure why.....

atward commented 7 years ago

@delfick Upgrading to radssh 1.1.x would make the following line pointless: https://github.com/delfick/bespin/blob/9789ec2dbf07b8af00ea4875f7e359b801a7a4c0/bespin/operations/ssh.py#L48

RadSSH now wants this value set via ssh config. Having the value set will result in a warning:

radssh/config.py:156: UserWarning: OBSOLETE: [hostkey.verify] found in radssh_config is ignored.
    Set StrictHostKeyChecking in standard SSH Config file (~/.ssh/config)

I'm against writing a custom ssh_config for the connection - bespin should instead honor any settings in ssh_config(5).

Are you fine with the approach to remove the 'hostkey verification disabling' from bespin.operations.ssh and update documentation to instruct users to add StrictHostKeyChecking=no to their ssh config?

delfick commented 7 years ago

yeah I'm fine with that