-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix ssh host policy #4966
base: master
Are you sure you want to change the base?
Fix ssh host policy #4966
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #4966 +/- ##
==========================================
+ Coverage 86.41% 86.66% +0.24%
==========================================
Files 439 438 -1
Lines 42717 42535 -182
==========================================
- Hits 36914 36863 -51
+ Misses 5803 5672 -131 ☔ View full report in Codecov by Sentry. |
@@ -83,7 +82,7 @@ def _can_connect(host: str, port: int = DEFAULT_SSH_PORT) -> bool: | |||
logger.debug("Testing connection to host %s", host) | |||
client = paramiko.SSHClient() | |||
client.load_system_host_keys() | |||
client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) | |||
client.set_missing_host_key_policy(paramiko.RejectPolicy()) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pretty sure for this to work we will need to create some custom policy like:
class CustomHostKeyPolicy(paramiko.client.MissingHostKeyPolicy):
def missing_host_key(self, client, hostname, key):
# if hostname is like `algo-*` autoadd otherwise reject
client = paramiko.SSHClient()
client.set_missing_host_key_policy(CustomHostKeyPolicy)
Issue #, if available: #4946
Description of changes: Change the SSH host policy to reject when missing
Testing done: Unit + integration
Merge Checklist
Put an
x
in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your pull request.General
Tests
unique_name_from_base
to create resource names in integ tests (if appropriate)By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.