Skip to content

fix(ssh): confirm changed host identities - #297

Open
DatScreamer wants to merge 3 commits into
0xSero:mainfrom
DatScreamer:fix/ssh-host-key-change-confirmation
Open

fix(ssh): confirm changed host identities#297
DatScreamer wants to merge 3 commits into
0xSero:mainfrom
DatScreamer:fix/ssh-host-key-change-confirmation

Conversation

@DatScreamer

@DatScreamer DatScreamer commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Protect saved-server and terminal SSH reconnects from silently accepting a changed host identity.

Changes

  • Share the platform-backed SSH trust store with server connections and reconnect orchestration.
  • Pin accepted first-use host fingerprints by normalized host and port.
  • Reject changed fingerprints and expose an explicit replacement operation.
  • Add Replace Stored Identity and Cancel confirmation dialogs on iOS and Android.
  • Handle changed-key challenges for terminal sessions and saved-server reconnects.

Verification

  • Manually tested by me in the iOS simulator and the Android emulator:
    • Confirmed a first-use host fingerprint is accepted and pinned.
    • Rotated the SSH server host key and confirmed the app surfaces the "SSH Host Identity Changed" confirmation on reconnect, on both iOS and Android, with Replace Stored Identity restoring the connection.
    • iOS cold app-start foreground reconnect also surfaces the confirmation.
  • git diff --check passes.

Closes #296

@DatScreamer
DatScreamer marked this pull request as draft August 14, 2026 13:26
@DatScreamer
fix(ssh): surface host-key verification errors across all connect paths
5df1a4f 
russh reports a rejected host key as UnknownKey from client::connect, but
the code only checked the rejected-fingerprint flag after a successful
connect, so the typed HostKeyVerification error (and the host-key-changed
marker) never fired in any flow. Check the rejected fingerprint on the
connect-error path too.

Also wire the trust-store pin policy into the flows that still accepted
every key: the guided SSH connect, ssh_connect_and_bootstrap,
ssh_open_session, and the SSH bridge reconnect plan. Pin on first connect
and reject changed host identities.

iOS: route host-key-changed during guided connect to the confirm modal
instead of a hard Connection Failed dialog, and add keychain-access-groups
to the Debug entitlements so the simulator Keychain (trust store) works.
@DatScreamer
DatScreamer marked this pull request as ready for review August 15, 2026 01:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Handle changed SSH host identities during reconnect

1 participant

@DatScreamer