JSch SFTP security with session.setConfig("StrictHostKeyChecking", "no");

sftp jsch public-key key-pair
Tony picture Tony · May 12, 2015 · Viewed 13.9k times · Source

I use JSch with private key to FTP file

  1. jsch.addIdentity(privatekeyfile);
  2. Session session = jsch.getSession( "user", "domain.com" ,22);
  3. session.setConfig("StrictHostKeyChecking", "no");

Line 3 is in question. Without this line, JSch does not work.

My question is: Will line 3 make SFTP transfer insecure?

Answer

Ben Damer picture Ben Damer · May 12, 2015

Disabling the StrictHostKeyChecking option will make the connection less secure than having the option enabled, because it will let you connect to remote servers without verifying their SSH host keys. If the option is enabled, you will only be able to connect to servers which keys are known to your SSH client.

You will have to decide what that means for your specific use case - are the servers you are connecting on a private, local network or do you connect over the internet? Is this a testing or production environment?

When in doubt, it is better to err on the side of more security. I would recommend enabling StricktHostKeyChecking and using the setKnownHosts method to provide a file which contains the remote host keys.

Related questions

How to resolve Java UnknownHostKey, while using JSch SFTP library?

I'm running a java program where I transfer a file from one folder to another, using Java SFTP. The problem I'm having is that I'm getting the following error in my Java SFTP (using JSch) : C:\Oracle\Middleware\Oracle_Home\…

Read More
What is use of config.put("StrictHostKeyChecking", "no") in JSch

java.util.Properties config = new java.util.Properties(); config.put("StrictHostKeyChecking", "no"); session.setConfig(config); In above code why we need to set StrictHostKeyChecking value as no while connection to SFTP through JSch API?

Read More
SFTP file transfer using Java JSch

Here is my code, which retrieves content of the file, on the remote server and display as output. package sshexample; import com.jcraft.jsch.*; import java.io.*; public class SSHexample { public static void main(String[] args) { String user = "user"; String …

Read More