You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "davsclaus (via GitHub)" <gi...@apache.org> on 2026/05/12 09:50:23 UTC

[PR] CAMEL-23404: Improve SFTP security documentation and add strictHostKeyChecking policy enforcement [camel]

davsclaus opened a new pull request, #23143:
URL: https://github.com/apache/camel/pull/23143

   ## Summary
   
   Improves documentation and adds security policy enforcement for the `strictHostKeyChecking` parameter in the SFTP component, as requested in [CAMEL-23404](https://issues.apache.org/jira/browse/CAMEL-23404).
   
   ## Changes
   
   ### 1. Security Annotation (`BaseSftpConfiguration.java`)
   - Added `security = "insecure:ssl"` to the `strictHostKeyChecking` parameter annotation
   - Enhanced the description to explicitly warn about MITM vulnerability when set to `no`
   - This enables the security policy framework to warn/fail when strictHostKeyChecking=no is used in production
   
   ### 2. Documentation (`sftp-component.adoc`)
   - Added new "Security Best Practices: Host Key Verification" section
   - Included WARNING admonition about the insecure default (`strictHostKeyChecking=no`)
   - Provided multiple examples showing secure configuration patterns:
     - Using `knownHostsFile` with `strictHostKeyChecking=yes`
     - Using `knownHostsUri` for classpath-loaded known hosts
     - Relying on `~/.ssh/known_hosts` (default behavior)
   - Explained the relationship with the security policy enforcement framework
   
   ### 3. Generated Metadata (`sftp.json`)
   - Regenerated component metadata to include the `security: "insecure:ssl"` attribute
   - Updated parameter description in the JSON metadata
   
   ## Test Plan
   
   - [x] Built camel-ftp-common and camel-ftp modules successfully
   - [x] Unit tests pass (56 tests run, 0 failures)
   - [x] Code generation executed successfully
   - [x] Verified generated JSON includes security attribute
   - [ ] Manual verification: test SFTP connection with `strictHostKeyChecking=yes` (requires SFTP server)
   - [ ] Security policy framework integration test (requires `camel.security.insecureSslPolicy=fail`)
   
   ## Documentation
   
   Documentation has been enhanced with:
   - Clear warning about the security implications of the default value
   - Multiple secure configuration examples
   - Explanation of host key verification
   - Links to security policy framework documentation
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code) on behalf of Claus Ibsen


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CAMEL-23404: Improve SFTP security documentation and add strictHostKeyChecking policy enforcement [camel]

Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on PR #23143:
URL: https://github.com/apache/camel/pull/23143#issuecomment-4429841230

   Added host key security options on component level so it can be configured globally and much easier


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CAMEL-23404: Improve SFTP security documentation and add strictHostKeyChecking policy enforcement [camel]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #23143:
URL: https://github.com/apache/camel/pull/23143#issuecomment-4429467739

   :star2: Thank you for your contribution to the Apache Camel project! :star2:
     :robot: CI automation will test this PR automatically.
   
     :camel: Apache Camel Committers, please review the following items:
   
     * First-time contributors **require MANUAL approval** for the GitHub Actions to run
     * You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
     * You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
     * Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
     
     :warning: Be careful when sharing logs. Review their contents before sharing them publicly.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CAMEL-23404: Improve SFTP security documentation and add strictHostKeyChecking policy enforcement [camel]

Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus merged PR #23143:
URL: https://github.com/apache/camel/pull/23143


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org