Do not ignore SSH host validation

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: go-security/ssh-ignore-keys

Language: Go

Severity: Warning

Category: Security

CWE: 295

Description

SSH host validation should never be ignored and always be enforced to avoid man-in-the-middle attacks.

Learn More

Non-Compliant Code Examples

package main

import (
	"golang.org/x/crypto/ssh"
)

func main() {
	_ =  ssh.InsecureIgnoreHostKey()
}

Compliant Code Examples

package main

import (
	"golang.org/x/crypto/ssh"
)

func main() {
	// not valid in tests
	_ =  ssh.InsecureIgnoreHostKey()
}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Analysis