Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upGitHub is where the world builds software
Millions of developers and companies build, ship, and maintain their software on GitHub — the largest and most advanced development platform in the world.
Default SSH config creates errors for missing "known_hosts" #454
Comments
|
I'm not keen on making this the default as it implies a level of trust on the destination server without review which may contravene some company security policies. It also hides any changes in the event there is some malicious change on the destination host. If you wish to use this for your own env, you can add these options to the backup-utils/backup.config-example Lines 31 to 35 in e3d5053 |
|
One can. modify it in a local copy of GHE_EXTRA_SSH_OPTS, yes. That's what I've done for some automated setups, especially setups where the user doing the backup does not have write permission to their home directory for a service user, but only has permission to write to the "data" directory. I do think that at least tossing in a commented out GHE_EXTRA_SSH_OPTS with these options would be useful, and I'd be happy to submit a pull request for it. The confusing behavior of ".ssh/known_hosts" has been an issue and a source of unreliable behavior since SSH was first created in the 1990's. |
I think this is something better suited to the documentation, possibly as a note on https://github.com/github/backup-utils/blob/master/docs/scheduling-backups.md or a new FAQ. |
There is a classic problem for automatic tasks and the default ssh_config options, one that causes failures when a Github Enterprise has never had an SSH connection on port 122 done by a new user in an automatic or cron job task, because the SSH hostkey is not already stored in $HOME/.ssh/known_hosts. The simplest workaround is to simply disable the use of known_hosts. This is usually done by using these SSH command line options.
-oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null -oLogLevel=ERRO