Tweak paramiko missing hostkey policies

lib/galaxy/jobs/runners/util/cli/shell/rsh.py

@@ -41,11 +41,11 @@ class RemoteShell(LocalShell):
 
 
 class SecureShell(RemoteShell):
-    SSH_NEW_KEY_STRING = 'Are you sure you want to continue connecting'
 
     def __init__(self, rsh='ssh', rcp='scp', private_key=None, port=None, strict_host_key_checking=True, **kwargs):
-        strict_host_key_checking = "yes" if string_as_bool(strict_host_key_checking) else "no"
-        options = ["-o", "StrictHostKeyChecking=%s" % strict_host_key_checking]
+        options = []
+        if not string_as_bool(strict_host_key_checking):
+            options.extend(["-o", "StrictHostKeyChecking=no", "-o", "UserKnownHostsFile=/dev/null"])
         options.extend(["-o", "ConnectTimeout=60"])
         if private_key:
             options.extend(['-i', private_key])
@@ -56,13 +56,14 @@ class SecureShell(RemoteShell):
 
 class ParamikoShell(object):
 
-    def __init__(self, username, hostname, password=None, private_key=None, port=22, timeout=60, **kwargs):
+    def __init__(self, username, hostname, password=None, private_key=None, port=22, timeout=60, strict_host_key_checking=True, **kwargs):
         self.username = username
         self.hostname = hostname
         self.password = password
         self.private_key = private_key
         self.port = int(port) if port else port
         self.timeout = int(timeout) if timeout else timeout
+        self.strict_host_key_checking = string_as_bool(strict_host_key_checking)
         self.ssh = None
         self.retry_action_executor = RetryActionExecutor(max_retries=100, interval_max=300)
         self.connect()
@@ -70,7 +71,7 @@ class ParamikoShell(object):
     def connect(self):
         log.info("Attempting establishment of new paramiko SSH channel")
         self.ssh = paramiko.SSHClient()
-        self.ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+        self.ssh.set_missing_host_key_policy(paramiko.RejectPolicy() if self.strict_host_key_checking else paramiko.WarningPolicy())
         self.ssh.connect(hostname=self.hostname,
                          port=self.port,
                          username=self.username,

test/unit/test_remote_shell.py

@@ -23,6 +23,7 @@ class TestCliInterface(unittest.TestCase):
         cls.username = 'testuser'
         cls.shell_params = {'username': cls.username,
                             'private_key': cls.ssh_keys.private_key_file,
+                            'strict_host_key_checking': False,
                             'hostname': 'localhost'}
         cls.cli_interface = CliInterface()