Import known_hosts from web URL

[mettlerr]

Would be helpful to be able to import known_hosts and then be able to turn on StrictHostKeyChecking to disable access to hosts not in known_hosts. Furthermore it would be great, if this would be tried to sync with the configured URL on startup.

Reason: known_hosts is available from an URL in our company behind a VPN.

[isontheline]

Hey @mettlerr 👋

Thanks for your feedback 🙏

known_hosts is available from an URL in our company behind a VPN.

Your known_hostsavailable behind your URL is using the same format as the standard OpenSSH?

then be able to turn on StrictHostKeyChecking to disable access to hosts not in known_hosts

So in "WebSSH high security mode" all connections will be prevented to unknown ones?
Are you OK that you won't be able to add/connect "personal" ones?

[mettlerr]

Yes, format is same as standard OpenSSH.

Good point about not being able to add personal ones, which do not belong to my company. This has to be given some thought... Maybe a hostgroup with a setting, which enforces strict mode? But then known_host would have to be a per-hostgroup basis, which makes things more complex on the application side... Hmmm... Will gather feedback company internal and report back.

[isontheline]

Will gather feedback company internal and report back.

Many thanks for gathering additional feedback 🙏
Your idea is a good one for companies!

[mettlerr]

OpenSSH is handling it like such: https://linux-audit.com/ssh/config/client/option-stricthostkeychecking/

Having the option to set it to "accept-new" or "no" instead of just "ask" (which is probably standard now) and "yes", would be a good option, without the complexity of different host group settings. Then people can set it to whatever they want, depending on their needs.

[isontheline]

I will upgrade WebSSH in order to be more compliant with this option. Yet WebSSH is on "hybrid" ask mode warning user on first time and when host key is changed but let the user to passthrough.

[isontheline]

I've converted the discussion to a issue : #1460