Skip to content

ssh-no-host-key-verification (S507)#

Derived from the flake8-bandit linter.

What it does#

Checks for uses of policies disabling SSH verification in Paramiko.

Why is this bad?#

By default, Paramiko checks the identity of the remote host when establishing an SSH connection. Disabling the verification might lead to the client connecting to a malicious host, without the client knowing.

Example#

from paramiko import client

ssh_client = client.SSHClient()
ssh_client.set_missing_host_key_policy(client.AutoAddPolicy)

Use instead:

from paramiko import client

ssh_client = client.SSHClient()
ssh_client.set_missing_host_key_policy(client.RejectPolicy)

References#