[SSHD-1259] DefaultKnownHostsServerKeyVerifier not checking all Key algorithms present in known_hosts

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.8.0
• Fix Version/s: 2.10.1, 2.11.0
• Assignee: Unassigned
• Reporter: Klaus Nguetsa
• Created: 04/Apr/22 13:59
• Updated: 09/Oct/23 20:21
• Resolved: 29/May/23 09:01

Description

Hello everyone,

Assuming I have the following known_hosts file containing twice the public key of the same host but with different algorithms.:

 

lserver1 ssh-dss XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
#
lserver1 ecdsa-sha2-nistp256 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

 

 

During the connection when I use DefaultKnownHostsServerKeyVerifier  to verify the keys, if the target host presents a ecdsa-sha2-nistp256 key, the verification will fail because DefaultKnownHostsServerKeyVerifier  seems to match to the first occurence of the hostname in the know_host file. Therefore It will match the key lserver1 ssh-dss XXXXXXXXXXXX... and the comparison to the same key but with ecdsa-sha2-nistp256 algorithm presented by the target host will fail. Shouldn't it iterate through the file until the right combination (hostname, algorithm) is found?  This way it could check with lserver1 ecdsa-sha2-nistp256 XXXX..... instead of lserver1 ssh-dss XXXXX......

This works fine with openssh. 

Thanks

 

Issue Links

• links to: GitHub Pull Request #368