https://bugs.kde.org/show_bug.cgi?id=527222
Bug ID: 527222
Summary: KIO SFTP fails host verification with known hosts and
then adds duplicate entries after clicking "Connect
Anyway"
Classification: Frameworks and Libraries
Product: kio-extras
Version First 26.08.2
Reported In:
Platform: Arch Linux
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: SFTP
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
DESCRIPTION
Today, KIO SFTP prompted me for Host Verification when connecting to my NAS
even though it was already present in my known_hosts and has been for a while.
I clicked "Connect Anyway", which caused it to add numerous duplicate entries
into my known_hosts.
I believe this may be related to Arch's upgrade to the openssh package
(10.6p1-1 -> 10.6p1-2) which added ML-DSA host keys:
https://gitlab.archlinux.org/archlinux/packaging/packages/openssh/-/commit/1a02f622427ca06998c9ece00d895cd05e09f388
Here's what the lines in known_hosts look like
192.168.8.149 ssh-ed25519 <key 1>
192.168.8.149 ssh-rsa <key 2>
192.168.8.149 ecdsa-sha2-nistp256 <key 3>
192.168.8.149 ssh-mldsa44-ed25519 <Key 4>
192.168.8.149 ssh-ed25519 <key 1>
192.168.8.149 ssh-ed25519 <key 1>
192.168.8.149 ssh-ed25519 <key 1>
192.168.8.149 ssh-ed25519 <key 1>
192.168.8.149 ssh-ed25519 <key 1>
I've redacted the keys, but hopefully it's clear that all the <key 1> lines are
the same and duplicated. The first 4 lines were generated by a regular SSH
login via the terminal. The other 5 lines that are duplicates of the first are
created when connecting with Dolphin via SFTP and clicking "Connect Anyway" on
the Host Verification dialog.
For certain hosts, Dolphin will actually ask for Host verification repeatedly,
causing even more duplicate ssh-ed25519 entries.
STEPS TO REPRODUCE
1. Setup an SSH server. It most likely needs to be configured with ML-DSA host
keys like the Arch commit shows
2. Remove all references to that host from your known_hosts file
3. Connect to the SSH server via a regular terminal
4. Verify that 4 lines are added to known_hosts and that SSH is able to verify
the host after the initial connection
5. Connect to that same SSH host with Dolphin via sftp
6. Notice "Host verification" prompt pops up even though host is already
present in known_hosts
7. Click "Connect Anyway"
8. Notice duplicate entries added to known_hosts
OBSERVED RESULT
Dolphin reprompts for host verification even though the host is already in
known_hosts. It also adds duplicate ssh-ed25519 entries.
EXPECTED RESULT
Dolphin should not re-prompt for host verification. There should be no
duplicate entries added into known_hosts
SOFTWARE/OS VERSIONS
Operating System: Arch Linux
KDE Plasma Version: 6.8.0
KDE Frameworks Version: 6.31.0
Qt Version: 6.12.0
Kernel Version: 7.2.10-arch1-1 (64-bit)
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen 7 9800X3D 8-Core Processor
Memory: 64 GiB of RAM (62.4 GiB usable)
Graphics Processor: NVIDIA GeForce RTX 3090
Manufacturer: Gigabyte Technology Co., Ltd.
Product Name: X870E AORUS ELITE WIFI7
openssh package version 10.6p1-2
--
You are receiving this mail because:
You are watching all bug changes.
