Skip to content

Commit

Permalink
Fixed security issue raised by CI, by removing
Browse files Browse the repository at this point in the history
ssh.InsecureIgnoreHostKey(), and instead using known_hosts file for
host-key verification.
  • Loading branch information
sudhar-krishnakumar committed Dec 31, 2024
1 parent 108bb18 commit ad74157
Showing 1 changed file with 20 additions and 1 deletion.
21 changes: 20 additions & 1 deletion ipu-plugin/pkg/ipuplugin/lifecycleservice.go
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@ import (
"strings"
"time"

kh "golang.org/x/crypto/ssh/knownhosts"

"github.com/intel/ipu-opi-plugins/ipu-plugin/pkg/p4rtclient"
"github.com/intel/ipu-opi-plugins/ipu-plugin/pkg/types"
"github.com/intel/ipu-opi-plugins/ipu-plugin/pkg/utils"
Expand Down Expand Up @@ -953,12 +955,29 @@ func skipIMCReboot() (bool, string) {
// The param(acc_apf) appears in 3 lines in that file, and we run
// the command to fetch the value in the second line.
func queryNumAccApfsInIMCConfig() (int, error) {

log.Infof("queryNumAccApfsInIMCConfig")
//remove duplicate entries, and ensure host-key(ssh-keyscan) is present.
sshCmds := "ssh-keygen -R 192.168.0.1; ssh-keyscan 192.168.0.1 >> /root/.ssh/known_hosts"

_, err := utils.ExecuteScript(sshCmds)
if err != nil {
log.Errorf("error->%v, for ssh key commands->%v", err, sshCmds)
return 0, fmt.Errorf("error->%v, for ssh key commands->%v", err, sshCmds)
}

hostKeyCallback, err := kh.New("/root/.ssh/known_hosts")
if err != nil {
log.Errorf("error->%v, unable to create hostkeycallback function: ", err)
return 0, fmt.Errorf("error->%v, unable to create hostkeycallback function: ", err)
}

config := &ssh.ClientConfig{
User: "root",
Auth: []ssh.AuthMethod{
ssh.Password(""),
},
HostKeyCallback: ssh.InsecureIgnoreHostKey(),
HostKeyCallback: hostKeyCallback,
}

// Connect to the remote server.
Expand Down

0 comments on commit ad74157

Please sign in to comment.