glsec

Rules / GL048

GL048 SSH with StrictHostKeyChecking disabled

Severity: error
OWASP: CICD-SEC-7 – Insecure System Configuration
CWE: CWE-295 – Improper Certificate Validation

Risk

Passing -o StrictHostKeyChecking=no to ssh, scp, sftp, or rsync disables host key verification entirely. The SSH client will connect to any host without checking whether its key matches a previously trusted entry, making the connection vulnerable to man-in-the-middle attacks on shared runner networks.

The same risk applies when StrictHostKeyChecking no is written to ~/.ssh/config at pipeline runtime, which affects all subsequent SSH connections in the job.

GL030 flags ssh-keyscan (which blindly trusts whatever key the remote host presents at scan time). This rule covers the complementary pattern: disabling the check at connection time.

What is flagged

Script lines (in script:, before_script:, after_script:, or a run: step) that contain StrictHostKeyChecking set to no or off, in any common form:

ssh -o StrictHostKeyChecking=no deploy@host
scp -o StrictHostKeyChecking=no dist/ deploy@host:/var/www/
sftp -o StrictHostKeyChecking=no deploy@host
rsync -e "ssh -o StrictHostKeyChecking=no" dist/ deploy@host:/var/www/
echo "StrictHostKeyChecking no" >> ~/.ssh/config

Trigger example

deploy:
  script:
    - ssh -o StrictHostKeyChecking=no deploy@$HOST "systemctl restart app"
    - scp -o StrictHostKeyChecking=no dist/ deploy@$HOST:/var/www/

Safe alternative

Store a pre-verified known_hosts entry as a masked, protected CI/CD variable and install it before connecting:

deploy:
  before_script:
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    - echo "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
    - chmod 644 ~/.ssh/known_hosts
  script:
    - ssh deploy@$HOST "systemctl restart app"

Generate $SSH_KNOWN_HOSTS once from a trusted network:

ssh-keyscan -H your-server.example.com

Store the output as a protected, masked CI/CD variable.

Notes

Documentation for glsec 1.23.0. Source of this page · Rule implementation