[GH-ISSUE #78] security: implement SSH host key verification (TOFU) #103

New issue

Open

opened 2026-03-07 19:27:42 +03:00 by kerem · 0 comments

kerem commented

2026-03-07 19:27:42 +03:00

Owner

Originally created by @adminsyspro on GitHub (Mar 6, 2026).
Original GitHub issue: https://github.com/adminsyspro/proxcenter-ui/issues/78

Problem

All SSH connections (rolling updates, test-ssh, replication) use InsecureIgnoreHostKey, making them vulnerable to man-in-the-middle attacks.

Expected

Implement Trust On First Use (TOFU): store the host key fingerprint on first connection, then verify it on subsequent connections. Alert the user if the fingerprint changes.

Implementation notes

New DB field: add sshHostKey (or sshFingerprint) to ManagedHost model
First connection: store the fingerprint, log it
Subsequent connections: compare fingerprint, reject if mismatch
UI: show fingerprint per node in infrastructure settings, allow manual reset
Go orchestrator: same logic for rolling updates and replication SSH connections
Consider supporting both the frontend (ssh2 library) and backend (golang.org/x/crypto/ssh)

Priority

Medium — requires network-level MITM to exploit, but important for hardened environments.

Originally created by @adminsyspro on GitHub (Mar 6, 2026). Original GitHub issue: https://github.com/adminsyspro/proxcenter-ui/issues/78 ## Problem All SSH connections (rolling updates, test-ssh, replication) use `InsecureIgnoreHostKey`, making them vulnerable to man-in-the-middle attacks. ## Expected Implement Trust On First Use (TOFU): store the host key fingerprint on first connection, then verify it on subsequent connections. Alert the user if the fingerprint changes. ## Implementation notes - **New DB field**: add `sshHostKey` (or `sshFingerprint`) to `ManagedHost` model - **First connection**: store the fingerprint, log it - **Subsequent connections**: compare fingerprint, reject if mismatch - **UI**: show fingerprint per node in infrastructure settings, allow manual reset - **Go orchestrator**: same logic for rolling updates and replication SSH connections - Consider supporting both the frontend (ssh2 library) and backend (golang.org/x/crypto/ssh) ## Priority Medium — requires network-level MITM to exploit, but important for hardened environments.