What is config.put ("StrictHostKeyChecking", "no") in JSch

Question

java.util.Properties config = new java.util.Properties();            
config.put("StrictHostKeyChecking", "no");
session.setConfig(config);

In the above code, we need to set the value StrictHostKeyCheckingas nowhen connecting to SFTP via the JSch API?

Answer 1

You should not really install it. You lose most of SSH / SFTP security by doing this.

The option tells the JSch SSH / SFTP library not to verify the public key of the SSH / SFTP server. You are vulnerable to a man-in-the-middle attack if you do not verify the public key. Of course, if you do not connect to a private trusted network (therefore, you do not need security / encryption).

SSH/SFTP:
https://www.symantec.com/connect/articles/ssh-host-key-protection
https://winscp.net/eng/docs/ssh_verifying_the_host_key

Answer 2

• StrictHostKeyChecking: | | default: ask yes'', jsch will never automatically add host keys to the $HOME/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed. This property forces the user to manually add all new hosts. If this property is set to no '', jsch . `` ask '', , , , jsch , .