[IMP] storage_backend_sftp: add security and compatibility options#554
Open
[IMP] storage_backend_sftp: add security and compatibility options#554
Conversation
Add several improvements to the SFTP storage backend: Security: - Add optional host key verification to prevent MITM attacks - Support for known_hosts file format or direct key content Compatibility: - Add legacy SSH algorithms support for older servers (banks, etc.) - Disable rsa-sha2-256/512 to force ssh-rsa signing when needed - Force ssh-rsa key type priority for legacy servers Usability: - Accept file paths (~/..., /path/to) in addition to key content - Support bytes and file-like objects for key inputs - Normalize all key inputs through a common helper function Debugging: - Add optional verbose logging field for detailed diagnostics - Log server version, ciphers, and key fingerprints when enabled - Show accepted auth methods on authentication failure - Separate key exchange from authentication for better error reporting
IJOL
force-pushed
the
16.0-add-sftp-security-options
branch
from
1400f05 to
8aa8cca
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds security and compatibility improvements to the SFTP storage backend:
sftp_legacy_algorithmsfield enablesssh-rsafor older SFTP servers (like bank servers) that don't support modern key exchange algorithmssftp_verify_hostkeyandsftp_hostkeyfields allow verifying the server's host key to prevent MITM attacks~/.ssh/id_rsa) in addition to direct content, plus bytes and file-like objectsNew fields
sftp_legacy_algorithmssftp_verify_hostkeysftp_hostkeyKey input formats supported
-----BEGIN RSA PRIVATE KEY-----...~/.ssh/id_rsaor/path/to/keyb'-----BEGIN...'open('key.pem')Test plan