[BUG] StrictHostKeyChecking=accept-new causes install failure on OpenSSH <7.6

[luxaritas]

As seen in the comments on npm/cli#3233 and #7, trying to install a git repository with the current npm CLI fails
when using OpenSSH <7.6 with the following:

npm ERR! command git --no-replace-objects ls-remote ssh://git@gitserver.com/foo/bar.git
npm ERR! command-line line 0: unsupported option "accept-new".
npm ERR! fatal: Could not read from remote repository.

While the change is in theory a good one (I was caught off guard with the old behavior when cloning a repository failed due to a missing host key), it creates issues in practice.

• OpenSSH >= 7.6 probably can't be expected - at the very least in my case, on an up-to-date Amazon Linux, I'm stuck with 7.4p1 from the repositories, and I'd rather not compile from source.
• This implementation overrides .git/config and ~/.gitconfig, contrary to the PR (and ~/.ssh/config as well, as someone pointed out)

Proposals I've seen include:

• Verifying the current ssh version (ssh -V) before attempting to use accept-new
• Wholesale reversion of fix: default to accepting new ssh host key fingerprints #7

[darcyclarke]

@nlf if you're looking at this repo &/or changing anything can you review this issue

[nlf]

😞 i was operating under the assumption that a nearly 4 year old release of openssh was going to be a low enough bar that this would be reasonable, but it appears not if Amazon Linux doesn't have it. we'll revisit this and try to come up with another way. thanks for the report!

[adamlounds]

One workaround for anyone else finding this: specify the GIT_SSH_COMMAND env var when calling npm, eg GIT_SSH_COMMAND="ssh" npm install

[joshuawinsor]

Even if this didn't error, it is still problematic as it downgrades ssh security by default.

[kumarrishav]

I am facing the same issue as well. What's the solution for this other than updating openssh version or using workaround?

[pkyeck]

we'll revisit this and try to come up with another way.

@nlf did you come up with something?

[lacksfish]

This is a breaking change imho and should be communicated as such.
Some of my Dockerfiles stopped working due to this code change.

What if no newer version of OpenSSH is available ? Will there be a working fallback ?

[Mayank16799]

@joshuawinsor Can you please elaborate on what security concerns may be caused, or any active issues that someone faced. As I am using GIT_SSH_COMMAND="ssh" npm ci as a workaround.
Is there any other way?

[joshuawinsor]

the default ssh implementation is the following in order taking the first one that comes up

commandline options
~/.ssh/config
/etc/ssh/ssh_config
StrictHostChecking=yes

This overrides all of that to use a weaker security model than the default (and you may not think it is that much weaker, but it is weaker otherwise ssh would set accept-new by default).

The proper way to do this for gitlab (or whoever it is that isn't properly doing their ssh server farm to maintain an ssh host id) to fix their implementation.

Until that point users should simply add that host to ~/.ssh/config to have StrictHostChecking accept-new

Also there are systems that I have used that make it difficult to set environment variables on all my npm commands. Again this makes ssh ignore what you have set for StrictHostChecking in your .ssh/config

[Alzy]

Currently facing this issue. I've tried exporting GIT_SSH_COMMAND=ssh but it did not work. I am trying this on AWS ElasticBeanstalk (Node.js 16 running on 64bit Amazon Linux 2/5.5.3) which runs OpenSSH_7.4p1. Am I missing something? I set the environment variable using the export keyword within hook inside of .platform/hooks/prebuild. Is there a different way to do this?

I also attempted to install the latest openssh using ebextensions but it complained that version 8 does not exist within the yum repos. Any help would be greatly appreciated