MediumSupply chainBLWK-DEV-004

SSH doesn't check server identities (‹path›)

What this means

‹path› applies ‹detail› to every host, so SSH connects without verifying it is talking to the real server. Anyone in the network path can pose as GitHub, a deploy target or a bastion, capture what you type and push you modified code.

How to fix it

Remove the line, or use StrictHostKeyChecking accept-new, which trusts a server the first time and still refuses a key that later changes. Keep any exception inside a Host block for the one throw-away machine that needs it.

Check it yourself

Run a scan and look for BLWK-DEV-004 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads dev_tool_config and reports this check when:

kind == "ssh" and host_key_checks_off == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1557

Related checks

• Git skips TLS certificate checks (‹path›) · BLWK-DEV-001
• Git trusts repositories owned by anyone (‹path›) · BLWK-DEV-002
• Git allows the ext:: transport, which runs commands from a URL (‹path›) · BLWK-DEV-003
• SSH forwards your agent to every server (‹path›) · BLWK-DEV-005
• npm/yarn installs packages without checking TLS certificates (‹path›) · BLWK-DEV-006
• Packages are installed from a plain-HTTP registry (‹path›) · BLWK-DEV-007