CVE-2017-3204: Insufficient Information (NVD-CWE-noinfo)
value: The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.1
Published: 2017-04-04T14:59Z
Repository: https://github.com/golang/crypto
Language: Go
Files changed: ssh/agent/client_test.go, ssh/agent/example_test.go, ssh/agent/server_test.go, ssh/certs.go, ssh/client.go, ssh/client_auth_test.go, ssh/client_test.go, ssh/doc.go, ssh/example_test.go, ssh/handshake.go, ssh/handshake_test.go, ssh/session_test.go, ssh/test/cert_test.go
Commit date: 2017-03-30 15:57:35 +0000
Commit message: ssh: require host key checking in the ClientConfig

This change breaks existing behavior.

Before, a missing ClientConfig.HostKeyCallback would cause host key
checking to be disabled. In this configuration, establishing a
connection to any host just works, so today, most SSH client code in
the wild does not perform any host key checks.

This makes it easy to perform a MITM attack:

* SSH installations that use keyboard-interactive or password
authentication can be attacked with MITM, thereby stealing
passwords.

* Clients that use public-key authentication with agent forwarding are
also vulnerable: the MITM server could allow the login to succeed, and
then immediately ask the agent to authenticate the login to the real
server.

* Clients that use public-key authentication without agent forwarding
are harder to attack unnoticedly: an attacker cannot authenticate the
login to the real server, so it cannot in general present a convincing
server to the victim.

Now, a missing HostKeyCallback will cause the handshake to fail. This
change also provides InsecureIgnoreHostKey() and FixedHostKey(key) as
ready made host checkers.

A simplistic parser for OpenSSH's known_hosts file is given as an
example.  This change does not provide a full-fledged parser, as it
has complexity (wildcards, revocation, hashed addresses) that will
need further consideration.

When introduced, the host checking feature maintained backward
compatibility at the expense of security. We have decided this is not
the right tradeoff for the SSH library.

Fixes golang/go#19767

Change-Id: I45fc7ba9bd1ea29c31ec23f115cdbab99913e814
Reviewed-on: https://go-review.googlesource.com/38701
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Diff: diff --git a/ssh/agent/client_test.go b/ssh/agent/client_test.go
index a13a650..93d3a9c 100644
--- a/ssh/agent/client_test.go
+++ b/ssh/agent/client_test.go
@@ -231,11 +231,13 @@ func TestAuth(t *testing.T) {
 			t.Fatalf("Server: %v", err)
 		}
 		conn.Close()
 	}()
 
-	conf := ssh.ClientConfig{}
+	conf := ssh.ClientConfig{
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+	}
 	conf.Auth = append(conf.Auth, ssh.PublicKeysCallback(agent.Signers))
 	conn, _, _, err := ssh.NewClientConn(b, "", &conf)
 	if err != nil {
 		t.Fatalf("NewClientConn: %v", err)
 	}
diff --git a/ssh/agent/example_test.go b/ssh/agent/example_test.go
index c1130f7..8556225 100644
--- a/ssh/agent/example_test.go
+++ b/ssh/agent/example_test.go
@@ -4,33 +4,34 @@
 
 package agent_test
 
 import (
 	"log"
-	"os"
 	"net"
+	"os"
 
-        "golang.org/x/crypto/ssh"
-        "golang.org/x/crypto/ssh/agent"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/agent"
 )
 
 func ExampleClientAgent() {
 	// ssh-agent has a UNIX socket under $SSH_AUTH_SOCK
 	socket := os.Getenv("SSH_AUTH_SOCK")
-        conn, err := net.Dial("unix", socket)
-        if err != nil {
-                log.Fatalf("net.Dial: %v", err)
-        }
+	conn, err := net.Dial("unix", socket)
+	if err != nil {
+		log.Fatalf("net.Dial: %v", err)
+	}
 	agentClient := agent.NewClient(conn)
 	config := &ssh.ClientConfig{
 		User: "username",
 		Auth: []ssh.AuthMethod{
 			// Use a callback rather than PublicKeys
 			// so we only consult the agent once the remote server
 			// wants it.
 			ssh.PublicKeysCallback(agentClient.Signers),
 		},
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
 	}
 
 	sshc, err := ssh.Dial("tcp", "localhost:22", config)
 	if err != nil {
 		log.Fatalf("Dial: %v", err)
diff --git a/ssh/agent/server_test.go b/ssh/agent/server_test.go
index ec9cdee..6b0837d 100644
--- a/ssh/agent/server_test.go
+++ b/ssh/agent/server_test.go
@@ -54,11 +54,13 @@ func TestSetupForwardAgent(t *testing.T) {
 			t.Fatalf("Server: %v", err)
 		}
 		incoming <- conn
 	}()
 
-	conf := ssh.ClientConfig{}
+	conf := ssh.ClientConfig{
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+	}
 	conn, chans, reqs, err := ssh.NewClientConn(b, "", &conf)
 	if err != nil {
 		t.Fatalf("NewClientConn: %v", err)
 	}
 	client := ssh.NewClient(conn, chans, reqs)
diff --git a/ssh/certs.go b/ssh/certs.go
index 6331c94..67600e2 100644
--- a/ssh/certs.go
+++ b/ssh/certs.go
@@ -266,11 +266,11 @@ type CertChecker struct {
 	UserKeyFallback func(conn ConnMetadata, key PublicKey) (*Permissions, error)
 
 	// HostKeyFallback is called when CertChecker.CheckHostKey encounters a
 	// public key that is not a certificate. It must implement host key
 	// validation or else, if nil, all such keys are rejected.
-	HostKeyFallback func(addr string, remote net.Addr, key PublicKey) error
+	HostKeyFallback HostKeyCallback
 
 	// IsRevoked is called for each certificate so that revocation checking
 	// can be implemented. It should return true if the given certificate
 	// is revoked and false otherwise. If nil, no certificates are
 	// considered to have been revoked.
diff --git a/ssh/client.go b/ssh/client.go
index c97f297..667e371 100644
--- a/ssh/client.go
+++ b/ssh/client.go
@@ -3,10 +3,11 @@
 // license that can be found in the LICENSE file.
 
 package ssh
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"net"
 	"sync"
 	"time"
@@ -66,10 +67,15 @@ func NewClient(c Conn, chans <-chan NewChannel, reqs <-chan *Request) *Client {
 // as the underlying transport.  The Request and NewChannel channels
 // must be serviced or the connection will hang.
 func NewClientConn(c net.Conn, addr string, config *ClientConfig) (Conn, <-chan NewChannel, <-chan *Request, error) {
 	fullConf := *config
 	fullConf.SetDefaults()
+	if fullConf.HostKeyCallback == nil {
+		c.Close()
+		return nil, nil, nil, errors.New("ssh: must specify HostKeyCallback")
+	}
+
 	conn := &connection{
 		sshConn: sshConn{conn: c},
 	}
 
 	if err := conn.clientHandshake(addr, &fullConf); err != nil {
@@ -171,10 +177,17 @@ func Dial(network, addr string, config *ClientConfig) (*Client, error) {
 		return nil, err
 	}
 	return NewClient(c, chans, reqs), nil
 }
 
+// HostKeyCallback is the function type used for verifying server
+// keys.  A HostKeyCallback must return nil if the host key is OK, or
+// an error to reject it. It receives the hostname as passed to Dial
+// or NewClientConn. The remote address is the RemoteAddr of the
+// net.Conn underlying the the SSH connection.
+type HostKeyCallback func(hostname string, remote net.Addr, key PublicKey) error
+
 // A ClientConfig structure is used to configure a Client. It must not be
 // modified after having been passed to an SSH function.
 type ClientConfig struct {
 	// Config contains configuration that is shared between clients and
 	// servers.
@@ -186,14 +199,16 @@ type ClientConfig struct {
 	// Auth contains possible authentication methods to use with the
 	// server. Only the first instance of a particular RFC 4252 method will
 	// be used during authentication.
 	Auth []AuthMethod
 
-	// HostKeyCallback, if not nil, is called during the cryptographic
-	// handshake to validate the server's host key. A nil HostKeyCallback
-	// implies that all host keys are accepted.
-	HostKeyCallback func(hostname string, remote net.Addr, key PublicKey) error
+	// HostKeyCallback is called during the cryptographic
+	// handshake to validate the server's host key. The client
+	// configuration must supply this callback for the connection
+	// to succeed. The functions InsecureIgnoreHostKey or
+	// FixedHostKey can be used for simplistic host key checks.
+	HostKeyCallback HostKeyCallback
 
 	// ClientVersion contains the version identification string that will
 	// be used for the connection. If empty, a reasonable default is used.
 	ClientVersion string
 
@@ -207,5 +222,35 @@ type ClientConfig struct {
 	// Timeout is the maximum amount of time for the TCP connection to establish.
 	//
 	// A Timeout of zero means no timeout.
 	Timeout time.Duration
 }
+
+// InsecureIgnoreHostKey returns a function that can be used for
+// ClientConfig.HostKeyCallback to accept any host key. It should
+// not be used for production code.
+func InsecureIgnoreHostKey() HostKeyCallback {
+	return func(hostname string, remote net.Addr, key PublicKey) error {
+		return nil
+	}
+}
+
+type fixedHostKey struct {
+	key PublicKey
+}
+
+func (f *fixedHostKey) check(hostname string, remote net.Addr, key PublicKey) error {
+	if f.key == nil {
+		return fmt.Errorf("ssh: required host key was nil")
+	}
+	if !bytes.Equal(key.Marshal(), f.key.Marshal()) {
+		return fmt.Errorf("ssh: host key mismatch")
+	}
+	return nil
+}
+
+// FixedHostKey returns a function for use in
+// ClientConfig.HostKeyCallback to accept only a specific host key.
+func FixedHostKey(key PublicKey) HostKeyCallback {
+	hk := &fixedHostKey{key}
+	return hk.check
+}
diff --git a/ssh/client_auth_test.go b/ssh/client_auth_test.go
index e384c79..b526f66 100644
--- a/ssh/client_auth_test.go
+++ b/ssh/client_auth_test.go
@@ -90,10 +90,11 @@ func TestClientAuthPublicKey(t *testing.T) {
 	config := &ClientConfig{
 		User: "testuser",
 		Auth: []AuthMethod{
 			PublicKeys(testSigners["rsa"]),
 		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
 	if err := tryAuth(t, config); err != nil {
 		t.Fatalf("unable to dial remote side: %s", err)
 	}
 }
@@ -102,10 +103,11 @@ func TestAuthMethodPassword(t *testing.T) {
 	config := &ClientConfig{
 		User: "testuser",
 		Auth: []AuthMethod{
 			Password(clientPassword),
 		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
 
 	if err := tryAuth(t, config); err != nil {
 		t.Fatalf("unable to dial remote side: %s", err)
 	}
@@ -121,10 +123,11 @@ func TestAuthMethodFallback(t *testing.T) {
 				func() (string, error) {
 					passwordCalled = true
 					return "WRONG", nil
 				}),
 		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
 
 	if err := tryAuth(t, config); err != nil {
 		t.Fatalf("unable to dial remote side: %s", err)
 	}
@@ -139,10 +142,11 @@ func TestAuthMethodWrongPassword(t *testing.T) {
 		User: "testuser",
 		Auth: []AuthMethod{
 			Password("wrong"),
 			PublicKeys(testSigners["rsa"]),
 		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
 
 	if err := tryAuth(t, config); err != nil {
 		t.Fatalf("unable to dial remote side: %s", err)
 	}
@@ -156,10 +160,11 @@ func TestAuthMethodKeyboardInteractive(t *testing.T) {
 	config := &ClientConfig{
 		User: "testuser",
 		Auth: []AuthMethod{
 			KeyboardInteractive(answers.Challenge),
 		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
 
 	if err := tryAuth(t, config); err != nil {
 		t.Fatalf("unable to dial remote side: %s", err)
 	}
@@ -201,10 +206,11 @@ func TestAuthMethodRSAandDSA(t *testing.T) {
 	config := &ClientConfig{
 		User: "testuser",
 		Auth: []AuthMethod{
 			PublicKeys(testSigners["dsa"], testSigners["rsa"]),
 		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
 	if err := tryAuth(t, config); err != nil {
 		t.Fatalf("client could not authenticate with rsa key: %v", err)
 	}
 }
@@ -217,10 +223,11 @@ func TestClientHMAC(t *testing.T) {
 				PublicKeys(testSigners["rsa"]),
 			},
 			Config: Config{
 				MACs: []string{mac},
 			},
+			HostKeyCallback: InsecureIgnoreHostKey(),
 		}
 		if err := tryAuth(t, config); err != nil {
 			t.Fatalf("client could not authenticate with mac algo %s: %v", mac, err)
 		}
 	}
@@ -252,10 +259,11 @@ func TestClientUnsupportedKex(t *testing.T) {
 			PublicKeys(),
 		},
 		Config: Config{
 			KeyExchanges: []string{"diffie-hellman-group-exchange-sha256"}, // not currently supported
 		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
 	if err := tryAuth(t, config); err == nil || !strings.Contains(err.Error(), "common algorithm") {
 		t.Errorf("got %v, expected 'common algorithm'", err)
 	}
 }
@@ -271,11 +279,12 @@ func TestClientLoginCert(t *testing.T) {
 	if err != nil {
 		t.Fatalf("NewCertSigner: %v", err)
 	}
 
 	clientConfig := &ClientConfig{
-		User: "user",
+		User:            "user",
+		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
 	clientConfig.Auth = append(clientConfig.Auth, PublicKeys(certSigner))
 
 	// should succeed
 	if err := tryAuth(t, clientConfig); err != nil {
@@ -361,10 +370,11 @@ func testPermissionsPassing(withPermissions bool, t *testing.T) {
 
 	clientConfig := &ClientConfig{
 		Auth: []AuthMethod{
 			PublicKeys(testSigners["rsa"]),
 		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
 	if withPermissions {
 		clientConfig.User = "permissions"
 	} else {
 		clientConfig.User = "nopermissions"
@@ -407,10 +417,11 @@ func TestRetryableAuth(t *testing.T) {
 				n++
 				return p, nil
 			}), 2),
 			PublicKeys(testSigners["rsa"]),
 		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
 
 	if err := tryAuth(t, config); err != nil {
 		t.Fatalf("unable to dial remote side: %s", err)
 	}
@@ -428,11 +439,12 @@ func ExampleRetryableAuthMethod(t *testing.T) {
 	Cb := func(user, instruction string, questions []string, echos []bool) (answers []string, err error) {
 		return []string{"answer1", "answer2"}, nil
 	}
 
 	config := &ClientConfig{
-		User: user,
+		HostKeyCallback: InsecureIgnoreHostKey(),
+		User:            user,
 		Auth: []AuthMethod{
 			RetryableAuthMethod(KeyboardInteractiveChallenge(Cb), NumberOfPrompts),
 		},
 	}
 
@@ -448,11 +460,12 @@ func TestClientAuthNone(t *testing.T) {
 		NoClientAuth: true,
 	}
 	serverConfig.AddHostKey(testSigners["rsa"])
 
 	clientConfig := &ClientConfig{
-		User: user,
+		User:            user,
+		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
 
 	c1, c2, err := netPipe()
 	if err != nil {
 		t.Fatalf("netPipe: %v", err)
diff --git a/ssh/client_test.go b/ssh/client_test.go
index 1fe790c..bc5e985 100644
--- a/ssh/client_test.go
+++ b/ssh/client_test.go
@@ -4,17 +4,19 @@
 
 package ssh
 
 import (
 	"net"
+	"strings"
 	"testing"
 )
 
 func testClientVersion(t *testing.T, config *ClientConfig, expected string) {
 	clientConn, serverConn := net.Pipe()
 	defer clientConn.Close()
 	receivedVersion := make(chan string, 1)
+	config.HostKeyCallback = InsecureIgnoreHostKey()
 	go func() {
 		version, err := readVersion(serverConn)
 		if err != nil {
 			receivedVersion <- ""
 		} else {
@@ -35,5 +37,45 @@ func TestCustomClientVersion(t *testing.T) {
 }
 
 func TestDefaultClientVersion(t *testing.T) {
 	testClientVersion(t, &ClientConfig{}, packageVersion)
 }
+
+func TestHostKeyCheck(t *testing.T) {
+	for _, tt := range []struct {
+		name      string
+		wantError string
+		key       PublicKey
+	}{
+		{"no callback", "must specify HostKeyCallback", nil},
+		{"correct key", "", testSigners["rsa"].PublicKey()},
+		{"mismatch", "mismatch", testSigners["ecdsa"].PublicKey()},
+	} {
+		c1, c2, err := netPipe()
+		if err != nil {
+			t.Fatalf("netPipe: %v", err)
+		}
+		defer c1.Close()
+		defer c2.Close()
+		serverConf := &ServerConfig{
+			NoClientAuth: true,
+		}
+		serverConf.AddHostKey(testSigners["rsa"])
+
+		go NewServerConn(c1, serverConf)
+		clientConf := ClientConfig{
+			User: "user",
+		}
+		if tt.key != nil {
+			clientConf.HostKeyCallback = FixedHostKey(tt.key)
+		}
+
+		_, _, _, err = NewClientConn(c2, "", &clientConf)
+		if err != nil {
+			if tt.wantError == "" || !strings.Contains(err.Error(), tt.wantError) {
+				t.Errorf("%s: got error %q, missing %q", err.Error(), tt.wantError)
+			}
+		} else if tt.wantError != "" {
+			t.Errorf("%s: succeeded, but want error string %q", tt.name, tt.wantError)
+		}
+	}
+}
diff --git a/ssh/doc.go b/ssh/doc.go
index d6be894..67b7322 100644
--- a/ssh/doc.go
+++ b/ssh/doc.go
@@ -12,7 +12,10 @@ the multiplexed nature of SSH is exposed to users that wish to support
 others.
 
 References:
   [PROTOCOL.certkeys]: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.certkeys?rev=HEAD
   [SSH-PARAMETERS]:    http://www.iana.org/assignments/ssh-parameters/ssh-parameters.xml#ssh-parameters-1
+
+This package does not fall under the stability promise of the Go language itself,
+so its API may be changed when pressing needs arise.
 */
 package ssh // import "golang.org/x/crypto/ssh"
diff --git a/ssh/example_test.go b/ssh/example_test.go
index 4d2eabd..618398c 100644
--- a/ssh/example_test.go
+++ b/ssh/example_test.go
@@ -3,16 +3,20 @@
 // license that can be found in the LICENSE file.
 
 package ssh_test
 
 import (
+	"bufio"
 	"bytes"
 	"fmt"
 	"io/ioutil"
 	"log"
 	"net"
 	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
 
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/terminal"
 )
 
@@ -88,12 +92,10 @@ func ExampleNewServerConn() {
 		log.Fatal("failed to handshake: ", err)
 	}
 	// The incoming Request channel must be serviced.
 	go ssh.DiscardRequests(reqs)
 
-	// Service the incoming Channel channel.
-
 	// Service the incoming Channel channel.
 	for newChannel := range chans {
 		// Channels have a type, depending on the application level
 		// protocol intended. In the case of a shell, the type is
 		// "session" and ServerShell may be used to present a simple
@@ -129,20 +131,63 @@ func ExampleNewServerConn() {
 			}
 		}()
 	}
 }
 
+func ExampleHostKeyCheck() {
+	// Every client must provide a host key check.  Here is a
+	// simple-minded parse of OpenSSH's known_hosts file
+	host := "hostname"
+	file, err := os.Open(filepath.Join(os.Getenv("HOME"), ".ssh", "known_hosts"))
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer file.Close()
+
+	scanner := bufio.NewScanner(file)
+	var hostKey ssh.PublicKey
+	for scanner.Scan() {
+		fields := strings.Split(scanner.Text(), " ")
+		if len(fields) != 3 {
+			continue
+		}
+		if strings.Contains(fields[0], host) {
+			var err error
+			hostKey, _, _, _, err = ssh.ParseAuthorizedKey(scanner.Bytes())
+			if err != nil {
+				log.Fatalf("error parsing %q: %v", fields[2], err)
+			}
+			break
+		}
+	}
+
+	if hostKey == nil {
+		log.Fatalf("no hostkey for %s", host)
+	}
+
+	config := ssh.ClientConfig{
+		User:            os.Getenv("USER"),
+		HostKeyCallback: ssh.FixedHostKey(hostKey),
+	}
+
+	_, err = ssh.Dial("tcp", host+":22", &config)
+	log.Println(err)
+}
+
 func ExampleDial() {
+	var hostKey ssh.PublicKey
 	// An SSH client is represented with a ClientConn.
 	//
 	// To authenticate with the remote server you must pass at least one
-	// implementation of AuthMethod via the Auth field in ClientConfig.
+	// implementation of AuthMethod via the Auth field in ClientConfig,
+	// and provide a HostKeyCallback.
 	config := &ssh.ClientConfig{
 		User: "username",
 		Auth: []ssh.AuthMethod{
 			ssh.Password("yourpassword"),
 		},
+		HostKeyCallback: ssh.FixedHostKey(hostKey),
 	}
 	client, err := ssh.Dial("tcp", "yourserver.com:22", config)
 	if err != nil {
 		log.Fatal("Failed to dial: ", err)
 	}
@@ -164,10 +209,11 @@ func ExampleDial() {
 	}
 	fmt.Println(b.String())
 }
 
 func ExamplePublicKeys() {
+	var hostKey ssh.PublicKey
 	// A public key may be used to authenticate against the remote
 	// server by using an unencrypted PEM-encoded private key file.
 	//
 	// If you have an encrypted private key, the crypto/x509 package
 	// can be used to decrypt it.
@@ -186,10 +232,11 @@ func ExamplePublicKeys() {
 		User: "user",
 		Auth: []ssh.AuthMethod{
 			// Use the PublicKeys method for remote authentication.
 			ssh.PublicKeys(signer),
 		},
+		HostKeyCallback: ssh.FixedHostKey(hostKey),
 	}
 
 	// Connect to the remote server and perform the SSH handshake.
 	client, err := ssh.Dial("tcp", "host.com:22", config)
 	if err != nil {
@@ -197,15 +244,17 @@ func ExamplePublicKeys() {
 	}
 	defer client.Close()
 }
 
 func ExampleClient_Listen() {
+	var hostKey ssh.PublicKey
 	config := &ssh.ClientConfig{
 		User: "username",
 		Auth: []ssh.AuthMethod{
 			ssh.Password("password"),
 		},
+		HostKeyCallback: ssh.FixedHostKey(hostKey),
 	}
 	// Dial your ssh server.
 	conn, err := ssh.Dial("tcp", "localhost:22", config)
 	if err != nil {
 		log.Fatal("unable to connect: ", err)
@@ -224,16 +273,18 @@ func ExampleClient_Listen() {
 		fmt.Fprintf(resp, "Hello world!\n")
 	}))
 }
 
 func ExampleSession_RequestPty() {
+	var hostKey ssh.PublicKey
 	// Create client config
 	config := &ssh.ClientConfig{
 		User: "username",
 		Auth: []ssh.AuthMethod{
 			ssh.Password("password"),
 		},
+		HostKeyCallback: ssh.FixedHostKey(hostKey),
 	}
 	// Connect to ssh server
 	conn, err := ssh.Dial("tcp", "localhost:22", config)
 	if err != nil {
 		log.Fatal("unable to connect: ", err)
diff --git a/ssh/handshake.go b/ssh/handshake.go
index 8de6506..1b63ba8 100644
--- a/ssh/handshake.go
+++ b/ssh/handshake.go
@@ -72,11 +72,11 @@ type handshakeTransport struct {
 	// If the other side requests or confirms a kex, its kexInit
 	// packet is sent here for the write loop to find it.
 	startKex chan *pendingKex
 
 	// data for host key checking
-	hostKeyCallback func(hostname string, remote net.Addr, key PublicKey) error
+	hostKeyCallback HostKeyCallback
 	dialAddress     string
 	remoteAddr      net.Addr
 
 	// Algorithms agreed in the last key exchange.
 	algorithms *algorithms
@@ -612,14 +612,12 @@ func (t *handshakeTransport) client(kex kexAlgorithm, algs *algorithms, magics *
 
 	if err := verifyHostKeySignature(hostKey, result); err != nil {
 		return nil, err
 	}
 
-	if t.hostKeyCallback != nil {
-		err = t.hostKeyCallback(t.dialAddress, t.remoteAddr, hostKey)
-		if err != nil {
-			return nil, err
-		}
+	err = t.hostKeyCallback(t.dialAddress, t.remoteAddr, hostKey)
+	if err != nil {
+		return nil, err
 	}
 
 	return result, nil
 }
diff --git a/ssh/handshake_test.go b/ssh/handshake_test.go
index 1b83112..77d1aac 100644
--- a/ssh/handshake_test.go
+++ b/ssh/handshake_test.go
@@ -434,10 +434,11 @@ func testHandshakeErrorHandlingN(t *testing.T, readLimit, writeLimit int, couple
 
 	clientConf := Config{RekeyThreshold: 10 * minRekeyThreshold}
 	clientConf.SetDefaults()
 	clientConn := newHandshakeTransport(&errorKeyingTransport{b, -1, -1}, &clientConf, []byte{'a'}, []byte{'b'})
 	clientConn.hostKeyAlgorithms = []string{key.PublicKey().Type()}
+	clientConn.hostKeyCallback = InsecureIgnoreHostKey()
 	go clientConn.readLoop()
 	go clientConn.kexLoop()
 
 	var wg sync.WaitGroup
 
diff --git a/ssh/session_test.go b/ssh/session_test.go
index f35a378..7dce6dd 100644
--- a/ssh/session_test.go
+++ b/ssh/session_test.go
@@ -57,11 +57,12 @@ func dial(handler serverType, t *testing.T) *Client {
 			}()
 		}
 	}()
 
 	config := &ClientConfig{
-		User: "testuser",
+		User:            "testuser",
+		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
 
 	conn, chans, reqs, err := NewClientConn(c2, "", config)
 	if err != nil {
 		t.Fatalf("unable to dial remote side: %v", err)
@@ -639,11 +640,12 @@ func TestSessionID(t *testing.T) {
 	serverConf := &ServerConfig{
 		NoClientAuth: true,
 	}
 	serverConf.AddHostKey(testSigners["ecdsa"])
 	clientConf := &ClientConfig{
-		User: "user",
+		HostKeyCallback: InsecureIgnoreHostKey(),
+		User:            "user",
 	}
 
 	go func() {
 		conn, chans, reqs, err := NewServerConn(c1, serverConf)
 		if err != nil {
@@ -745,11 +747,13 @@ func TestHostKeyAlgorithms(t *testing.T) {
 		}
 	}
 
 	// By default, we get the preferred algorithm, which is ECDSA 256.
 
-	clientConf := &ClientConfig{}
+	clientConf := &ClientConfig{
+		HostKeyCallback: InsecureIgnoreHostKey(),
+	}
 	connect(clientConf, KeyAlgoECDSA256)
 
 	// Client asks for RSA explicitly.
 	clientConf.HostKeyAlgorithms = []string{KeyAlgoRSA}
 	connect(clientConf, KeyAlgoRSA)
diff --git a/ssh/test/cert_test.go b/ssh/test/cert_test.go
index 364790f..bc83e4f 100644
--- a/ssh/test/cert_test.go
+++ b/ssh/test/cert_test.go
@@ -34,11 +34,12 @@ func TestCertLogin(t *testing.T) {
 	if err != nil {
 		t.Fatalf("NewCertSigner: %v", err)
 	}
 
 	conf := &ssh.ClientConfig{
-		User: username(),
+		User:            username(),
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
 	}
 	conf.Auth = append(conf.Auth, ssh.PublicKeys(certSigner))
 	client, err := s.TryDial(conf)
 	if err != nil {
 		t.Fatalf("TryDial: %v", err)

Vulnerable code: 	conf := ssh.ClientConfig{}
	"os"
        "golang.org/x/crypto/ssh"
        "golang.org/x/crypto/ssh/agent"
        conn, err := net.Dial("unix", socket)
        if err != nil {
                log.Fatalf("net.Dial: %v", err)
        }
	conf := ssh.ClientConfig{}
	HostKeyFallback func(addr string, remote net.Addr, key PublicKey) error
	// HostKeyCallback, if not nil, is called during the cryptographic
	// handshake to validate the server's host key. A nil HostKeyCallback
	// implies that all host keys are accepted.
	HostKeyCallback func(hostname string, remote net.Addr, key PublicKey) error
		User: "user",
		User: user,
		User: user,
	// Service the incoming Channel channel.

	// implementation of AuthMethod via the Auth field in ClientConfig.
	hostKeyCallback func(hostname string, remote net.Addr, key PublicKey) error
	if t.hostKeyCallback != nil {
		err = t.hostKeyCallback(t.dialAddress, t.remoteAddr, hostKey)
		if err != nil {
			return nil, err
		}
		User: "testuser",
		User: "user",
	clientConf := &ClientConfig{}
		User: username(),
Fixed code: 	conf := ssh.ClientConfig{
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
	}
	"os"
	"golang.org/x/crypto/ssh"
	"golang.org/x/crypto/ssh/agent"
	conn, err := net.Dial("unix", socket)
	if err != nil {
		log.Fatalf("net.Dial: %v", err)
	}
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
	conf := ssh.ClientConfig{
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
	}
	HostKeyFallback HostKeyCallback
	"bytes"
	if fullConf.HostKeyCallback == nil {
		c.Close()
		return nil, nil, nil, errors.New("ssh: must specify HostKeyCallback")
	}

// HostKeyCallback is the function type used for verifying server
// keys.  A HostKeyCallback must return nil if the host key is OK, or
// an error to reject it. It receives the hostname as passed to Dial
// or NewClientConn. The remote address is the RemoteAddr of the
// net.Conn underlying the the SSH connection.
type HostKeyCallback func(hostname string, remote net.Addr, key PublicKey) error

	// HostKeyCallback is called during the cryptographic
	// handshake to validate the server's host key. The client
	// configuration must supply this callback for the connection
	// to succeed. The functions InsecureIgnoreHostKey or
	// FixedHostKey can be used for simplistic host key checks.
	HostKeyCallback HostKeyCallback

// InsecureIgnoreHostKey returns a function that can be used for
// ClientConfig.HostKeyCallback to accept any host key. It should
// not be used for production code.
func InsecureIgnoreHostKey() HostKeyCallback {
	return func(hostname string, remote net.Addr, key PublicKey) error {
		return nil
	}
}

type fixedHostKey struct {
	key PublicKey
}

func (f *fixedHostKey) check(hostname string, remote net.Addr, key PublicKey) error {
	if f.key == nil {
		return fmt.Errorf("ssh: required host key was nil")
	}
	if !bytes.Equal(key.Marshal(), f.key.Marshal()) {
		return fmt.Errorf("ssh: host key mismatch")
	}
	return nil
}

// FixedHostKey returns a function for use in
// ClientConfig.HostKeyCallback to accept only a specific host key.
func FixedHostKey(key PublicKey) HostKeyCallback {
	hk := &fixedHostKey{key}
	return hk.check
}
		HostKeyCallback: InsecureIgnoreHostKey(),
		HostKeyCallback: InsecureIgnoreHostKey(),
		HostKeyCallback: InsecureIgnoreHostKey(),
		HostKeyCallback: InsecureIgnoreHostKey(),
		HostKeyCallback: InsecureIgnoreHostKey(),
		HostKeyCallback: InsecureIgnoreHostKey(),
			HostKeyCallback: InsecureIgnoreHostKey(),
		HostKeyCallback: InsecureIgnoreHostKey(),
		User:            "user",
		HostKeyCallback: InsecureIgnoreHostKey(),
		HostKeyCallback: InsecureIgnoreHostKey(),
		HostKeyCallback: InsecureIgnoreHostKey(),
		HostKeyCallback: InsecureIgnoreHostKey(),
		User:            user,
		User:            user,
		HostKeyCallback: InsecureIgnoreHostKey(),
	"strings"
	config.HostKeyCallback = InsecureIgnoreHostKey()

func TestHostKeyCheck(t *testing.T) {
	for _, tt := range []struct {
		name      string
		wantError string
		key       PublicKey
	}{
		{"no callback", "must specify HostKeyCallback", nil},
		{"correct key", "", testSigners["rsa"].PublicKey()},
		{"mismatch", "mismatch", testSigners["ecdsa"].PublicKey()},
	} {
		c1, c2, err := netPipe()
		if err != nil {
			t.Fatalf("netPipe: %v", err)
		}
		defer c1.Close()
		defer c2.Close()
		serverConf := &ServerConfig{
			NoClientAuth: true,
		}
		serverConf.AddHostKey(testSigners["rsa"])

		go NewServerConn(c1, serverConf)
		clientConf := ClientConfig{
			User: "user",
		}
		if tt.key != nil {
			clientConf.HostKeyCallback = FixedHostKey(tt.key)
		}

		_, _, _, err = NewClientConn(c2, "", &clientConf)
		if err != nil {
			if tt.wantError == "" || !strings.Contains(err.Error(), tt.wantError) {
				t.Errorf("%s: got error %q, missing %q", err.Error(), tt.wantError)
			}
		} else if tt.wantError != "" {
			t.Errorf("%s: succeeded, but want error string %q", tt.name, tt.wantError)
		}
	}
}

This package does not fall under the stability promise of the Go language itself,
so its API may be changed when pressing needs arise.
	"bufio"
	"os"
	"path/filepath"
	"strings"
func ExampleHostKeyCheck() {
	// Every client must provide a host key check.  Here is a
	// simple-minded parse of OpenSSH's known_hosts file
	host := "hostname"
	file, err := os.Open(filepath.Join(os.Getenv("HOME"), ".ssh", "known_hosts"))
	if err != nil {
		log.Fatal(err)
	}
	defer file.Close()

	scanner := bufio.NewScanner(file)
	var hostKey ssh.PublicKey
	for scanner.Scan() {
		fields := strings.Split(scanner.Text(), " ")
		if len(fields) != 3 {
			continue
		}
		if strings.Contains(fields[0], host) {
			var err error
			hostKey, _, _, _, err = ssh.ParseAuthorizedKey(scanner.Bytes())
			if err != nil {
				log.Fatalf("error parsing %q: %v", fields[2], err)
			}
			break
		}
	}

	if hostKey == nil {
		log.Fatalf("no hostkey for %s", host)
	}

	config := ssh.ClientConfig{
		User:            os.Getenv("USER"),
		HostKeyCallback: ssh.FixedHostKey(hostKey),
	}

	_, err = ssh.Dial("tcp", host+":22", &config)
	log.Println(err)
}

	var hostKey ssh.PublicKey
	// implementation of AuthMethod via the Auth field in ClientConfig,
	// and provide a HostKeyCallback.
		HostKeyCallback: ssh.FixedHostKey(hostKey),
	var hostKey ssh.PublicKey
		HostKeyCallback: ssh.FixedHostKey(hostKey),
	var hostKey ssh.PublicKey
		HostKeyCallback: ssh.FixedHostKey(hostKey),
	var hostKey ssh.PublicKey
		HostKeyCallback: ssh.FixedHostKey(hostKey),
	hostKeyCallback HostKeyCallback
	err = t.hostKeyCallback(t.dialAddress, t.remoteAddr, hostKey)
	if err != nil {
		return nil, err
	clientConn.hostKeyCallback = InsecureIgnoreHostKey()
		User:            "testuser",
		HostKeyCallback: InsecureIgnoreHostKey(),
		HostKeyCallback: InsecureIgnoreHostKey(),
		User:            "user",
	clientConf := &ClientConfig{
		HostKeyCallback: InsecureIgnoreHostKey(),
	}
		User:            username(),
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),