Amaan0907 opened a new issue, #733: URL: https://github.com/apache/airavata/issues/733
`dialSSH` in `internal/orchestration/ssh.go` uses `ssh.InsecureIgnoreHostKey()` as the `HostKeyCallback`, so Airavata never verifies the identity of the cluster or storage host it connects to. This makes man-in-the-middle attacks possible on SSH and SCP traffic, including any 2FA codes added through #729. Raised in #729, where @DImuthuUpe asked for a separate issue. I'd like to work on this. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
