Add SSH Host Key Verification to Web Shell #10

New Issue

2026-02-16T14:34:35Z

boris commented

2026-02-16 14:34:35 +00:00

As a security-conscious user I want browser shell sessions to verify SSH host identity in order for me to avoid MITM risk.

Acceptance Criteria:

Within 14 calendar days, web shell SSH command uses strict host key checking with managed known-hosts data.
Shell connection fails closed on host key mismatch and writes an audit event.
Server host key capture/update flow is documented and implemented.
Security regression test confirms MITM-style key mismatch is blocked.

As a security-conscious user I want browser shell sessions to verify SSH host identity in order for me to avoid MITM risk. Acceptance Criteria: Within 14 calendar days, web shell SSH command uses strict host key checking with managed known-hosts data. Shell connection fails closed on host key mismatch and writes an audit event. Server host key capture/update flow is documented and implemented. Security regression test confirms MITM-style key mismatch is blocked.

boris added this to the Minumum Marketable Product milestone 2026-02-16 14:34:35 +00:00

boris added the Kind/Security

Priority

Critical

1

labels 2026-02-16 14:34:35 +00:00

boris self-assigned this 2026-02-16 14:34:35 +00:00

boris added this to the Keywarden project 2026-02-16 14:34:35 +00:00

boris moved this to Review in Keywarden on 2026-03-28 21:48:44 +00:00

Sign in to join this conversation.