oscerd opened a new issue, #2955:
URL: https://github.com/apache/camel-kamelets/issues/2955
Three Kamelets declare `strictHostKeyChecking` with a default of `no`:
- `kamelets/sftp-sink.kamelet.yaml:98-102`
- `kamelets/sftp-source.kamelet.yaml:107-111`
- `kamelets/scp-sink.kamelet.yaml:70-74`
```yaml
strictHostKeyChecking:
...
default: no
```
With `no`, the client accepts any host key presented by the server, so the
connection is not bound to a known identity.
Separately, `ssh-sink` and `ssh-source` expose **no** host-key property at
all. The `camel-ssh` component only installs a verifier when
`knownHostsResource` is set, and neither Kamelet surfaces it — so an operator
cannot enable host-key verification through the Kamelet interface even if they
want to.
Proposal:
1. Change the default to `yes` in the three Kamelets above, and add
`knownHostsFile` / `knownHostsUri` properties so the default is usable.
2. Add `knownHostsResource` support to `ssh-sink` and `ssh-source`.
3. Upgrade-guide note — this changes behaviour for existing deployments.
_Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
