shubhamraj-git commented on code in PR #73419:
URL: https://github.com/apache/airflow/pull/73419#discussion_r4068805577
##########
providers/ssh/docs/connections/ssh.rst:
##########
@@ -51,7 +51,7 @@ Extra (optional)
* ``timeout`` - Deprecated - use conn_timeout instead.
* ``cmd_timeout`` - Timeout (in seconds) for executing the command. The
default is 10 seconds. `null` value means no timeout.
* ``compress`` - ``true`` to ask the remote client/server to compress
traffic; ``false`` to refuse compression. Default is ``true``.
- * ``no_host_key_check`` - Set to ``false`` to restrict connecting to hosts
with no entries in ``~/.ssh/known_hosts`` (Hosts file). This provides maximum
protection against trojan horse attacks, but can be troublesome when the
``/etc/ssh/ssh_known_hosts`` file is poorly maintained or connections to new
hosts are frequently made. This option forces the user to manually add all new
hosts. Default is ``true``, ssh will automatically add new host keys to the
user known hosts files.
+ * ``no_host_key_check`` - Set to ``true`` to connect to hosts that have no
entry in ``~/.ssh/known_hosts`` (Hosts file), automatically adding their key on
first connection. Default is ``false``, which restricts connecting to hosts
already present in the known hosts file. The default provides maximum
protection against trojan horse attacks, but can be troublesome when the
``/etc/ssh/ssh_known_hosts`` file is poorly maintained or connections to new
hosts are frequently made, because it forces the user to manually add all new
hosts.
Review Comment:
`no_host_key_check=true` does not consistently "automatically add" the host
key. AsyncSSH receives `known_hosts=None` and records nothing, while Paramiko
only persists an accepted key when a writable host-key file has already been
loaded. Could this instead say that the option "accepts unknown host keys
without requiring a known-hosts entry"? The same wording should be updated in
the SFTP connection documentation. No dedicated unit test is needed beyond
building the provider documentation.
---
Drafted-by: Codex (GPT-5); reviewed by @shubhamraj-git before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
