Changes for version 0.004 - 2026-09-20
- SECURITY: the server host key is now verified against known_hosts by default (CWE-322, reported privately via CPANSec). Previously Rex::Interface::Connection::LibSSH hardcoded strict_hostkeycheck => 0 and ignored the strict_hostkeycheck/knownhosts connect options, so the documented opt-in never did anything and any server -- including a man-in-the-middle -- was accepted. An unknown or changed key now fails the connection before authentication. Opt out per connection with strict_hostkeycheck => 0, or Rexfile-wide with -feature => ['disable_strict_host_key_checking'] (the same flag the OpenSSH backend honours); knownhosts => $file and Rex::Config->set_openssh_opt(UserKnownHostsFile => $file) select the file. Hosts that were never added to known_hosts (fresh Hetzner installs) must be ssh-keyscan'ed first or use the opt-out
- Requires Net::LibSSH 0.004, whose connect() performs the check
Modules
Rex SSH connection via Net::LibSSH (no SFTP required)
Rex command execution via Net::LibSSH exec channels
Rex remote file handle via Net::LibSSH exec channels
Rex filesystem operations via exec channels (no SFTP)
Rex connection backend using Net::LibSSH (no SFTP required)