JSch SFTP security with session.setConfig("StrictHostKeyChecking", "no");

Question

I use JSch with private key to FTP file

jsch.addIdentity(privatekeyfile);
Session session = jsch.getSession("user", "example.com", 22);    
session.setConfig("StrictHostKeyChecking", "no");

Line 3 is in question. Without this line, JSch does not work.

My question is: Will line 3 make SFTP transfer insecure?

Eliathas

Answer 1

Disabling the StrictHostKeyChecking option will make the connection less secure than having the option enabled, because it will let you connect to remote servers without verifying their SSH host keys. If the option is enabled, you will only be able to connect to servers which keys are known to your SSH client.

You will have to decide what that means for your specific use case - are the servers you are connecting on a private, local network or do you connect over the internet? Is this a testing or production environment?

When in doubt, it is better to err on the side of more security. I would recommend enabling StricktHostKeyChecking and using the setKnownHosts method to provide a file which contains the remote host keys.

Kirksey

ssh-keyscan -t rsa localhost produces something: # localhost SSH-2.0-OpenSSH_6.2 localhost ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfkfoFN+oakKAvx2meT90jom1oRdBevPFP/2A+tN4+ – Eliathas

In that case, your known_hosts file should contain the following line: abc.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfkfoFN+oakKAvx2meT90jom1oRdBevPFP/2A+tN4+ – Kirksey

Answer 2

Yes, it will make the connection (and the transfer) less secure. Particularly, it makes the connection open to Man-in-the-middle attacks.

You should never set the StrictHostKeyChecking to no, unless you do not care about security (such as when connecting within a private network).

It's not true that "Without this line, JSch does not work". You just have to make your code accept the expected server's host key. Either via the setKnownHosts or the setHostKeyRepository methods.

For examples, see How to resolve Java UnknownHostKey, while using JSch SFTP library?

---

You can read my article on verifying the host key to understand its importance. It's about WinSCP SSH/SFTP client, but it's generally true for any SSH client/library.

Marrymars