Disable host key verification

lorenzhs / instavpn

ABANDONED :: Create and set up an instant VPN using DigitalOcean and sshuttle

BSD 2-Clause "Simplified" License

10 stars 3 forks source link

Disable host key verification #4

Open lorenzhs opened 10 years ago

lorenzhs commented 10 years ago

The DigitalOcean API is accessed via a secure connection, and we can't detect a MITM to the VPN anyway (we have no way of getting the correct SSH host key), just disable verification, at least for the self-destruction mechanism: ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no

Also investigate if the same is possible for sshuttle

xhochy commented 10 years ago

We should ask "upstream" about this issues. MITM protection would be generally a really good "feature".

lorenzhs commented 10 years ago

True enough. Maybe we can convince DigitalOcean to add an API call to give us the machine host key (or include it in the status call, /droplets/[droplet_id])?