Known_hosts, SFTPClient, and Erlang SSH

I’ve spent some time mucking around SFTPClient because, unfortunately, my line of work requires me to deal with SFTP as one of the main means of getting data from various dinosaurs.

One of the major headaches I have hit, and I don’t think it has anything to do with SFTClient so much as something going on with the underlying Erlang tools is… known_hosts. Our deployed environments have read-only file systems so whenever we add another source for SFTP, I need the fingerprint to be in a static known_hosts file. This is actually fine and desirable in many ways except…

When I get a fingerprint from using ssh-keyscan or just trying ssh or sftp and checking my own known_hosts I’ll have a domain name. Whenever I connect through SFTPClient I end up with an IP address.

This is… not great. I want the domain name, not the IP because if that changes… things break and I gotta update the file and deploy. (Also, I’m not asking for solutions to this issue. Most of it is beyond my control.)

Not only is my Erlang not great, I’m a pretty casual SSH’er. When I have to do anything complicated I’m probably following a guide given to me by IT or some online guide. So my ignorance could be totally at play. The thing is, I don’t know where the issue really lies. Is this an Erlang library thing? The way SFTPClient is using Erlang? Something with an ssh config?

If anyone is more expert in this than me, please help! Haha. I’m working toward expanding my knowledge here but the number of hours in a day are painfully finite.

Not the exactly fix that you wanted, but you can silently accept host and not save the host: ssh — ssh v5.3.1

Then you avoid the issue with read only fs, and since you know the domain and likely use some form of authentication, then that is good enough. The known_host file is mostly to avoid domain hijacking, but in your case it’s the reverse.

I also want to add, if you’re concerned about MITM attacks here, don’t. You, your infrastructure provider and your clients would have bigger problems then.

2 Likes