Clank disables SSH host key checking? about clank HOT 1 CLOSED

This makes your Atmosphere server vulnerable to man-in-the-middle attacks. If you can corrupt my DNS or steal BGP routes upstream on the network (both of which are regularly used as attack vectors), then when I pull down code from version control to deploy a new release, you could point me to your evil git server and I'll get your evil code instead of my own, which I will then run as root, when I deploy with Clank.

I'm guessing host key checking was disabled so that the Atmosphere server can SSH to new instances (to run atmosphere-ansible) without knowing their host key ahead of time. If that is the case, here is a sketch of a better solution:

Each time an Atmosphere user launches an instance, we can generate a new SSH host keypair on the Atmosphere server. The public key would be added to the Atmosphere server's known_hosts file, and the keypair would be stored as instance metadata in OpenStack. We can pass a script as user_data to cloud-init which will retrieve the metadata and set the host keypair on the instance when it first boots. This way, the Atmosphere server will always have a reasonable assurance it is SSHing to the host that it intends to.

Bonus: we can display the instance's host key fingerprint to the user via the Troposphere UI and Atmosphere API, so that when a user SSHes to the instance and is prompted to accept the host key, he or she can also be reasonably assured that there is no man-in-the-middle attack.

@amercer1, @steve-gregory, et al., what do you think?

from clank.